From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42117) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X6ad2-00011b-Tv for qemu-devel@nongnu.org; Mon, 14 Jul 2014 03:24:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X6acw-00076E-R7 for qemu-devel@nongnu.org; Mon, 14 Jul 2014 03:24:52 -0400 Received: from ssl.dlhnet.de ([82.141.21.42]:45343) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X6acw-00075u-LK for qemu-devel@nongnu.org; Mon, 14 Jul 2014 03:24:46 -0400 Message-ID: <53C385BA.4090601@dlhnet.de> Date: Mon, 14 Jul 2014 09:24:42 +0200 From: Peter Lieven MIME-Version: 1.0 References: <1405074278-16230-1-git-send-email-kraxel@redhat.com> <1405074278-16230-4-git-send-email-kraxel@redhat.com> In-Reply-To: <1405074278-16230-4-git-send-email-kraxel@redhat.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Benjamin Herrenschmidt Cc: Gerd Hoffmann , qemu-devel@nongnu.org Hi Benjamin, On 11.07.2014 12:24, Gerd Hoffmann wrote: > From: Benjamin Herrenschmidt > > Commit b2eb849d4b1fdb6f35d5c46958c7f703cf64cfef > "CVE-2007-1320 - Cirrus LGD-54XX "bitblt" heap overflow" broke > cpu to video blits. > > When the ROP function is called from cirrus_bitblt_cputovideo_next(), > we pass 0 for the pitch but only operate on one line at a time. The > added test was tripping because after the initial substraction, the > pitch becomes negative. Make the test only trip when the height is > larger than one (ie. the pitch is actually used). > > This fixes HW cursor support in Windows NT4.0 (which otherwise was > a white rectangle) and general display of icons in that OS when using > 8bpp mode. > > Signed-off-by: Benjamin Herrenschmidt > Signed-off-by: Gerd Hoffmann > --- > hw/display/cirrus_vga_rop.h | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/hw/display/cirrus_vga_rop.h b/hw/display/cirrus_vga_rop.h > index 9c7bb09..0925a00 100644 > --- a/hw/display/cirrus_vga_rop.h > +++ b/hw/display/cirrus_vga_rop.h > @@ -52,8 +52,7 @@ glue(cirrus_bitblt_rop_fwd_, ROP_NAME)(CirrusVGAState *s, > dstpitch -= bltwidth; > srcpitch -= bltwidth; > > - if (dstpitch < 0 || srcpitch < 0) { > - /* is 0 valid? srcpitch == 0 could be useful */ > + if (bltheight > 1 && (dstpitch < 0 || srcpitch < 0)) { > return; > } > it seems you have digged into the cirrus code recently. Have you an idea how to fix the issue with the graphics corruption for cirrus vga and recent X Server versions? E.g. take an Ubuntu 14.04 Desktop CD, boot it into live mode and open terminal. I have tried to debug it a little, but I have no clue how to solve this. I tried to get hands on a real hardware Cirrus Logic Graphics card and test if this happens there as well, but I had no chance to get one. Peter