From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56105) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XwVIP-00016V-1f for qemu-devel@nongnu.org; Thu, 04 Dec 2014 07:14:14 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XwVIF-0006Jy-88 for qemu-devel@nongnu.org; Thu, 04 Dec 2014 07:14:08 -0500 Received: from mx1.redhat.com ([209.132.183.28]:60469) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XwVIF-0006Jb-1J for qemu-devel@nongnu.org; Thu, 04 Dec 2014 07:13:59 -0500 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id sB4CDwU1010542 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Thu, 4 Dec 2014 07:13:58 -0500 From: Gerd Hoffmann Date: Thu, 4 Dec 2014 13:13:38 +0100 Message-Id: <1417695221-27409-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PULL for-2.2 0/2] cirrus: fix blit region check (cve-2014-8106) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann Hi, Last minute pull req for 2.2, carrying a security fix for cirrus bitblit ops. please pull, Gerd The following changes since commit db12451decf7dfe0f083564183e135f2095228b9: Fix for crash after migration in virtio-rng on bi-endian targets (2014-11-28 13:06:00 +0000) are available in the git repository at: git://git.kraxel.org/qemu tags/pull-cve-2014-8106-20141204-1 for you to fetch changes up to bf25983345ca44aec3dd92c57142be45452bd38a: cirrus: don't overflow CirrusVGAState->cirrus_bltbuf (2014-12-01 10:25:46 +0100) ---------------------------------------------------------------- cirrus: fix blit region check ---------------------------------------------------------------- Gerd Hoffmann (2): cirrus: fix blit region check cirrus: don't overflow CirrusVGAState->cirrus_bltbuf hw/display/cirrus_vga.c | 65 ++++++++++++++++++++++++++++++++++++------------- 1 file changed, 48 insertions(+), 17 deletions(-)