debian/patches/extra/0020-display-qxl-render-fix-race-condition-in-qxl_cursor-.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Mauro Matteo Cascella <mcascell@redhat.com>
   3 Date: Thu, 7 Apr 2022 10:11:06 +0200
   4 Subject: [PATCH] display/qxl-render: fix race condition in qxl_cursor
   5  (CVE-2021-4207)
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 Avoid fetching 'width' and 'height' a second time to prevent possible
  11 race condition. Refer to security advisory
  12 https://starlabs.sg/advisories/22-4207/ for more information.
  13
  14 Fixes: CVE-2021-4207
  15 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
  16 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
  17 Message-Id: <20220407081106.343235-1-mcascell@redhat.com>
  18 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
  19 (cherry picked from commit 9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895)
  20 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  21 ---
  22  hw/display/qxl-render.c | 2 +-
  23  1 file changed, 1 insertion(+), 1 deletion(-)
  24
  25 diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
  26 index d28849b121..237ed293ba 100644
  27 --- a/hw/display/qxl-render.c
  28 +++ b/hw/display/qxl-render.c
  29 @@ -266,7 +266,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
  30          }
  31          break;
  32      case SPICE_CURSOR_TYPE_ALPHA:
  33 -        size = sizeof(uint32_t) * cursor->header.width * cursor->header.height;
  34 +        size = sizeof(uint32_t) * c->width * c->height;
  35          qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id);
  36          if (qxl->debug > 2) {
  37              cursor_print_ascii_art(c, "qxl/alpha");