debian/patches/extra/0021-ui-cursor-fix-integer-overflow-in-cursor_alloc-CVE-2.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Mauro Matteo Cascella <mcascell@redhat.com>
   3 Date: Thu, 7 Apr 2022 10:17:12 +0200
   4 Subject: [PATCH] ui/cursor: fix integer overflow in cursor_alloc
   5  (CVE-2021-4206)
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 Prevent potential integer overflow by limiting 'width' and 'height' to
  11 512x512. Also change 'datasize' type to size_t. Refer to security
  12 advisory https://starlabs.sg/advisories/22-4206/ for more information.
  13
  14 Fixes: CVE-2021-4206
  15 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
  16 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
  17 Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
  18 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
  19 (cherry picked from commit fa892e9abb728e76afcf27323ab29c57fb0fe7aa)
  20 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  21 ---
  22  hw/display/qxl-render.c | 7 +++++++
  23  hw/display/vmware_vga.c | 2 ++
  24  ui/cursor.c             | 8 +++++++-
  25  3 files changed, 16 insertions(+), 1 deletion(-)
  26
  27 diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
  28 index 237ed293ba..ca217004bf 100644
  29 --- a/hw/display/qxl-render.c
  30 +++ b/hw/display/qxl-render.c
  31 @@ -247,6 +247,13 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
  32      size_t size;
  33
  34      c = cursor_alloc(cursor->header.width, cursor->header.height);
  35 +
  36 +    if (!c) {
  37 +        qxl_set_guest_bug(qxl, "%s: cursor %ux%u alloc error", __func__,
  38 +                cursor->header.width, cursor->header.height);
  39 +        goto fail;
  40 +    }
  41 +
  42      c->hot_x = cursor->header.hot_spot_x;
  43      c->hot_y = cursor->header.hot_spot_y;
  44      switch (cursor->header.type) {
  45 diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
  46 index e2969a6c81..2b81d6122f 100644
  47 --- a/hw/display/vmware_vga.c
  48 +++ b/hw/display/vmware_vga.c
  49 @@ -509,6 +509,8 @@ static inline void vmsvga_cursor_define(struct vmsvga_state_s *s,
  50      int i, pixels;
  51
  52      qc = cursor_alloc(c->width, c->height);
  53 +    assert(qc != NULL);
  54 +
  55      qc->hot_x = c->hot_x;
  56      qc->hot_y = c->hot_y;
  57      switch (c->bpp) {
  58 diff --git a/ui/cursor.c b/ui/cursor.c
  59 index 1d62ddd4d0..835f0802f9 100644
  60 --- a/ui/cursor.c
  61 +++ b/ui/cursor.c
  62 @@ -46,6 +46,8 @@ static QEMUCursor *cursor_parse_xpm(const char *xpm[])
  63
  64      /* parse pixel data */
  65      c = cursor_alloc(width, height);
  66 +    assert(c != NULL);
  67 +
  68      for (pixel = 0, y = 0; y < height; y++, line++) {
  69          for (x = 0; x < height; x++, pixel++) {
  70              idx = xpm[line][x];
  71 @@ -91,7 +93,11 @@ QEMUCursor *cursor_builtin_left_ptr(void)
  72  QEMUCursor *cursor_alloc(int width, int height)
  73  {
  74      QEMUCursor *c;
  75 -    int datasize = width * height * sizeof(uint32_t);
  76 +    size_t datasize = width * height * sizeof(uint32_t);
  77 +
  78 +    if (width > 512 || height > 512) {
  79 +        return NULL;
  80 +    }
  81
  82      c = g_malloc0(sizeof(QEMUCursor) + datasize);
  83      c->width  = width;