* [Qemu-devel] [PATCH v1] cirrus: keep vga vram pointer within bounds
@ 2017-10-11 5:14 P J P
0 siblings, 0 replies; only message in thread
From: P J P @ 2017-10-11 5:14 UTC (permalink / raw)
To: Qemu Developers; +Cc: Gerd Hoffmann, niuguoxiang, Prasad J Pandit
From: Prasad J Pandit <pjp@fedoraproject.org>
'dst' pointer could exceed vga vram size when writing to the
cirrus memory area; it'd lead to an OOB access issue. Add check
to avoid it.
Reported-by: Niu Guoxiang <niuguoxiang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/display/cirrus_vga.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
Update: fixed coding style error, add space around '<<' operator.
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index afc290ab91..9f1f856679 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2047,8 +2047,11 @@ static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
}
val <<= 1;
dst++;
+ if (dst >= s->vga.vram_ptr + s->vga.vram_size) {
+ break;
+ }
}
- memory_region_set_dirty(&s->vga.vram, offset, 8);
+ memory_region_set_dirty(&s->vga.vram, offset, x);
}
static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
@@ -2071,8 +2074,11 @@ static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
}
val <<= 1;
dst += 2;
+ if (dst >= s->vga.vram_ptr + s->vga.vram_size) {
+ break;
+ }
}
- memory_region_set_dirty(&s->vga.vram, offset, 16);
+ memory_region_set_dirty(&s->vga.vram, offset, x << 1);
}
/***************************************
--
2.13.6
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2017-10-11 5:14 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-11 5:14 [Qemu-devel] [PATCH v1] cirrus: keep vga vram pointer within bounds P J P
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).