debian/patches/extra/CVE-2017-2620_cirrus_add_blit_is_unsafe_call_to_cirrus_bitblt_cputovideo.patch

   1 From d775c497a84a5c4be3f15cca85ca8440dd5880a0 Mon Sep 17 00:00:00 2001
   2 From: Gerd Hoffmann <kraxel@redhat.com>
   3 Date: Wed, 22 Feb 2017 13:42:31 +0100
   4 Subject: [PATCH qemu] cirrus: add blit_is_unsafe call to
   5  cirrus_bitblt_cputovideo (CVE-2017-2620)
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination
  11 and blit width, at all.  Oops.  Fix it.
  12
  13 Security impact: high.
  14
  15 The missing blit destination check allows to write to host memory.
  16 Basically same as CVE-2014-8106 for the other blit variants.
  17
  18 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
  19 Message-id: 1487679663-3264-1-git-send-email-kraxel@redhat.com
  20 ---
  21  hw/display/cirrus_vga.c | 8 ++++++++
  22  1 file changed, 8 insertions(+)
  23
  24 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
  25 index 1deb520..b9e7cb1 100644
  26 --- a/hw/display/cirrus_vga.c
  27 +++ b/hw/display/cirrus_vga.c
  28 @@ -900,6 +900,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
  29  {
  30      int w;
  31
  32 +    if (blit_is_unsafe(s, true)) {
  33 +        return 0;
  34 +    }
  35 +
  36      s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
  37      s->cirrus_srcptr = &s->cirrus_bltbuf[0];
  38      s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
  39 @@ -925,6 +929,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
  40         }
  41          s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
  42      }
  43 +
  44 +    /* the blit_is_unsafe call above should catch this */
  45 +    assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
  46 +
  47      s->cirrus_srcptr = s->cirrus_bltbuf;
  48      s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
  49      cirrus_update_memory_access(s);
  50 --
  51 2.1.4
  52