Changeset
hw/display/cirrus_vga.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
Test passed: s390x

loading

Test passed: checkpatch

loading

Test passed: docker

loading

Git apply log
Switched to a new branch '20171011051414.2826-1-ppandit@redhat.com'
Applying: cirrus: keep vga vram pointer within bounds
To https://github.com/patchew-project/qemu
 * [new tag]               patchew/20171011051414.2826-1-ppandit@redhat.com -> patchew/20171011051414.2826-1-ppandit@redhat.com
[Qemu-devel] [PATCH v1] cirrus: keep vga vram pointer within bounds
Posted by P J P, 1 week ago
From: Prasad J Pandit <pjp@fedoraproject.org>

'dst' pointer could exceed vga vram size when writing to the
cirrus memory area; it'd lead to an OOB access issue. Add check
to avoid it.

Reported-by: Niu Guoxiang <niuguoxiang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/display/cirrus_vga.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Update: fixed coding style error, add space around '<<' operator.

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index afc290ab91..9f1f856679 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2047,8 +2047,11 @@ static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
 	}
 	val <<= 1;
 	dst++;
+        if (dst >= s->vga.vram_ptr + s->vga.vram_size) {
+            break;
+        }
     }
-    memory_region_set_dirty(&s->vga.vram, offset, 8);
+    memory_region_set_dirty(&s->vga.vram, offset, x);
 }
 
 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
@@ -2071,8 +2074,11 @@ static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
 	}
 	val <<= 1;
 	dst += 2;
+        if (dst >= s->vga.vram_ptr + s->vga.vram_size) {
+            break;
+        }
     }
-    memory_region_set_dirty(&s->vga.vram, offset, 16);
+    memory_region_set_dirty(&s->vga.vram, offset, x << 1);
 }
 
 /***************************************
-- 
2.13.6