[OE-core][zeus][PATCH] qemu: CVE-2020-27616

Li Wang
2020-11-11T02:49:36Z

backport patch from:
https://git.qemu.org/?p=qemu.git;a=commit;h=ca1f9cbfdce4d63b10d57de80fef89a89d92a540

Signed-off-by: Li Wang <li.wang@windriver.com>
---
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2020-27616.patch | 53 +++++++++++++++++++
2 files changed, 54 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-27616.patch

diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 8f2d9e824b..0d20f0ccd7 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -47,6 +47,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2020-25084-1.patch \
file://CVE-2020-25084-2.patch \
file://CVE-2020-25625.patch \
+ file://CVE-2020-27616.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"

diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-27616.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-27616.patch
new file mode 100644
index 0000000000..76c2271aee
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-27616.patch
@@ -0,0 +1,53 @@
+From ca1f9cbfdce4d63b10d57de80fef89a89d92a540 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Wed, 21 Oct 2020 16:08:18 +0530
+Subject: [PATCH] ati: check x y display parameter values
+
+The source and destination x,y display parameters in ati_2d_blt()
+may run off the vga limits if either of s->regs.[src|dst]_[xy] is
+zero. Check the parameter values to avoid potential crash.
+
+Reported-by: Gaoning Pan <pgn@zju.edu.cn>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Message-id: 20201021103818.1704030-1-ppandit@redhat.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Upstream-Status: Backport
+CVE: CVE-2020-27616
+[https://git.qemu.org/?p=qemu.git;a=commit;h=ca1f9cbfdce4d63b10d57de80fef89a89d92a540]
+Signed-off-by: Li Wang <li.wang@windriver.com>
+---
+ hw/display/ati_2d.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
+index 23a8ae0..4dc10ea 100644
+--- a/hw/display/ati_2d.c
++++ b/hw/display/ati_2d.c
+@@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s)
+ dst_stride *= bpp;
+ }
+ uint8_t *end = s->vga.vram_ptr + s->vga.vram_size;
+- if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) *
+- dst_stride >= end) {
++ if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end
++ || dst_bits + dst_x
++ + (dst_y + s->regs.dst_height) * dst_stride >= end) {
+ qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
+ return;
+ }
+@@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s)
+ src_bits += s->regs.crtc_offset & 0x07ffffff;
+ src_stride *= bpp;
+ }
+- if (src_bits >= end || src_bits + src_x +
+- (src_y + s->regs.dst_height) * src_stride >= end) {
++ if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end
++ || src_bits + src_x
++ + (src_y + s->regs.dst_height) * src_stride >= end) {
+ qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
+ return;
+ }
+--
+2.17.1
+
--
2.17.1