]>
Commit | Line | Data |
---|---|---|
6ccd2869 FG |
1 | From 167d97a3def77ee2dbf6e908b0ecbfe2103977db Mon Sep 17 00:00:00 2001 |
2 | From: Prasad J Pandit <pjp@fedoraproject.org> | |
3 | Date: Thu, 8 Sep 2016 18:15:54 +0530 | |
4 | Subject: [PATCH] vmsvga: correct bitmap and pixmap size checks | |
5 | ||
6 | When processing svga command DEFINE_CURSOR in vmsvga_fifo_run, | |
7 | the computed BITMAP and PIXMAP size are checked against the | |
8 | 'cursor.mask[]' and 'cursor.image[]' array sizes in bytes. | |
9 | Correct these checks to avoid OOB memory access. | |
10 | ||
11 | Reported-by: Qinghao Tang <luodalongde@gmail.com> | |
12 | Reported-by: Li Qiang <liqiang6-s@360.cn> | |
13 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | |
14 | Message-id: 1473338754-15430-1-git-send-email-ppandit@redhat.com | |
15 | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | |
16 | --- | |
17 | hw/display/vmware_vga.c | 12 +++++++----- | |
18 | 1 file changed, 7 insertions(+), 5 deletions(-) | |
19 | ||
20 | diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c | |
21 | index e51a05e..6599cf0 100644 | |
22 | --- a/hw/display/vmware_vga.c | |
23 | +++ b/hw/display/vmware_vga.c | |
24 | @@ -676,11 +676,13 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s) | |
25 | cursor.bpp = vmsvga_fifo_read(s); | |
26 | ||
27 | args = SVGA_BITMAP_SIZE(x, y) + SVGA_PIXMAP_SIZE(x, y, cursor.bpp); | |
28 | - if (cursor.width > 256 || | |
29 | - cursor.height > 256 || | |
30 | - cursor.bpp > 32 || | |
31 | - SVGA_BITMAP_SIZE(x, y) > sizeof cursor.mask || | |
32 | - SVGA_PIXMAP_SIZE(x, y, cursor.bpp) > sizeof cursor.image) { | |
33 | + if (cursor.width > 256 | |
34 | + || cursor.height > 256 | |
35 | + || cursor.bpp > 32 | |
36 | + || SVGA_BITMAP_SIZE(x, y) | |
37 | + > sizeof(cursor.mask) / sizeof(cursor.mask[0]) | |
38 | + || SVGA_PIXMAP_SIZE(x, y, cursor.bpp) | |
39 | + > sizeof(cursor.image) / sizeof(cursor.image[0])) { | |
40 | goto badcmd; | |
41 | } | |
42 | ||
43 | -- | |
44 | 2.1.4 | |
45 |