From nobody Mon Apr 29 09:36:05 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1516872996289248.3925237808155; Thu, 25 Jan 2018 01:36:36 -0800 (PST) Received: from localhost ([::1]:56505 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eedxI-0003Qv-PL for importer@patchew.org; Thu, 25 Jan 2018 04:36:24 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51053) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eedw3-0002pX-Pc for qemu-devel@nongnu.org; Thu, 25 Jan 2018 04:35:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eedvx-0000yp-NN for qemu-devel@nongnu.org; Thu, 25 Jan 2018 04:35:07 -0500 Received: from mx1.redhat.com ([209.132.183.28]:55876) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eedvx-0000xb-Hn for qemu-devel@nongnu.org; Thu, 25 Jan 2018 04:35:01 -0500 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B5C4E5B2F4; Thu, 25 Jan 2018 09:35:00 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-116-227.ams2.redhat.com [10.36.116.227]) by smtp.corp.redhat.com (Postfix) with ESMTP id 629322D344; Thu, 25 Jan 2018 09:34:56 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 673C011ABC; Thu, 25 Jan 2018 10:34:55 +0100 (CET) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Thu, 25 Jan 2018 10:34:55 +0100 Message-Id: <20180125093455.6356-2-kraxel@redhat.com> In-Reply-To: <20180125093455.6356-1-kraxel@redhat.com> References: <20180125093455.6356-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Thu, 25 Jan 2018 09:35:00 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 1/1] vga: check the validation of memory addr when draw text X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linzhecheng , Gerd Hoffmann Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: linzhecheng Start a vm with qemu-kvm -enable-kvm -vnc :66 -smp 1 -m 1024 -hda redhat_5.11.qcow2 -device pcnet -vga cirrus, then use VNC client to connect to VM, and excute the code below in guest OS will lead to qemu crash: int main() { iopl(3); srand(time(NULL)); int a,b; while(1){ a =3D rand()%0x100; b =3D 0x3c0 + (rand()%0x20); outb(a,b); } return 0; } The above code is writing the registers of VGA randomly. We can write VGA CRT controller registers index 0x0C or 0x0D (which is the start address register) to modify the the display memory address of the upper left pixel or character of the screen. The address may be out of the range of vga ram. So we should check the validation of memory address when reading or writing it to avoid segfault. Signed-off-by: linzhecheng Message-id: 20180111132724.13744-1-linzhecheng@huawei.com Fixes: CVE-2018-5683 Signed-off-by: Gerd Hoffmann --- hw/display/vga.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/display/vga.c b/hw/display/vga.c index a0412000a5..6e78a4e156 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1279,6 +1279,9 @@ static void vga_draw_text(VGACommonState *s, int full= _update) cx_min =3D width; cx_max =3D -1; for(cx =3D 0; cx < width; cx++) { + if (src + sizeof(uint16_t) > s->vram_ptr + s->vram_size) { + break; + } ch_attr =3D *(uint16_t *)src; if (full_update || ch_attr !=3D *ch_attr_ptr || src =3D=3D cur= sor_ptr) { if (cx < cx_min) --=20 2.9.3