debian/patches/extra/CVE-2016-9921-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch

   1 From 9ec3cbedab41f93d2fbf742f2ca6705c2d68c3e1 Mon Sep 17 00:00:00 2001
   2 From: Prasad J Pandit <pjp@fedoraproject.org>
   3 Date: Tue, 18 Oct 2016 13:15:17 +0530
   4 Subject: [PATCH 12/12] display: cirrus: check vga bits per pixel(bpp) value
   5
   6 In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA,
   7 'cirrus_get_bpp' returns zero(0), which could lead to a divide
   8 by zero error in while copying pixel data. The same could occur
   9 via blit pitch values. Add check to avoid it.
  10
  11 Reported-by: Huawei PSIRT <psirt@huawei.com>
  12 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  13 Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com
  14 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
  15 ---
  16
  17 Notes:
  18     CVE-2016-9921
  19     CVE-2016-9922
  20
  21  hw/display/cirrus_vga.c | 14 ++++++++++----
  22  1 file changed, 10 insertions(+), 4 deletions(-)
  23
  24 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
  25 index 3d712d5..bdb092e 100644
  26 --- a/hw/display/cirrus_vga.c
  27 +++ b/hw/display/cirrus_vga.c
  28 @@ -272,6 +272,9 @@ static void cirrus_update_memory_access(CirrusVGAState *s);
  29  static bool blit_region_is_unsafe(struct CirrusVGAState *s,
  30                                    int32_t pitch, int32_t addr)
  31  {
  32 +    if (!pitch) {
  33 +        return true;
  34 +    }
  35      if (pitch < 0) {
  36          int64_t min = addr
  37              + ((int64_t)s->cirrus_blt_height-1) * pitch;
  38 @@ -715,7 +718,7 @@ static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
  39                                              s->cirrus_addr_mask));
  40  }
  41
  42 -static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
  43 +static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
  44  {
  45      int sx = 0, sy = 0;
  46      int dx = 0, dy = 0;
  47 @@ -729,6 +732,9 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
  48          int width, height;
  49
  50          depth = s->vga.get_bpp(&s->vga) / 8;
  51 +        if (!depth) {
  52 +            return 0;
  53 +        }
  54          s->vga.get_resolution(&s->vga, &width, &height);
  55
  56          /* extra x, y */
  57 @@ -783,6 +789,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
  58      cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
  59                                 s->cirrus_blt_dstpitch, s->cirrus_blt_width,
  60                                 s->cirrus_blt_height);
  61 +
  62 +    return 1;
  63  }
  64
  65  static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
  66 @@ -790,11 +798,9 @@ static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
  67      if (blit_is_unsafe(s))
  68          return 0;
  69
  70 -    cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
  71 +    return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
  72              s->cirrus_blt_srcaddr - s->vga.start_addr,
  73              s->cirrus_blt_width, s->cirrus_blt_height);
  74 -
  75 -    return 1;
  76  }
  77
  78  /***************************************
  79 --
  80 2.1.4
  81