Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: f153b563f8cf121aebf5a2fff5f0110faf58ccb3
https://github.com/qemu/qemu/commit/f153b563f8cf121aebf5a2fff5f0110faf58ccb3
Author: Wolfgang Bumiller <w.bumil...@proxmox.com>
Date: 2017-02-01 (Wed, 01 Feb 2017)
Changed paths:
M hw/display/cirrus_vga.c
Log Message:
-----------
cirrus: handle negative pitch in cirrus_invalidate_region()
cirrus_invalidate_region() calls memory_region_set_dirty()
on a per-line basis, always ranging from off_begin to
off_begin+bytesperline. With a negative pitch off_begin
marks the top most used address and thus we need to do an
initial shift backwards by a line for negative pitches of
backward blits, otherwise the first iteration covers the
line going from the start offset forwards instead of
backwards.
Additionally since the start address is inclusive, if we
shift by a full `bytesperline` we move to the first address
*not* included in the blit, so we only shift by one less
than bytesperline.
Signed-off-by: Wolfgang Bumiller <w.bumil...@proxmox.com>
Message-id: 1485352137-29367-1-git-send-email-w.bumil...@proxmox.com
[ kraxel: codestyle fixes ]
Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
Commit: 5858dd1801883309bdd208d72ddb81c4e9fee30c
https://github.com/qemu/qemu/commit/5858dd1801883309bdd208d72ddb81c4e9fee30c
Author: Wolfgang Bumiller <w.bumil...@proxmox.com>
Date: 2017-02-01 (Wed, 01 Feb 2017)
Changed paths:
M hw/display/cirrus_vga.c
Log Message:
-----------
cirrus: allow zero source pitch in pattern fill rops
The rops used by cirrus_bitblt_common_patterncopy only use
the destination pitch, so the source pitch shoul allowed to
be zero and the blit with used for the range check around the
source address.
Signed-off-by: Wolfgang Bumiller <w.bumil...@proxmox.com>
Message-id: 1485272138-23249-1-git-send-email-w.bumil...@proxmox.com
Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
Commit: 60cd23e85151525ab26591394c4e7e06fa07d216
https://github.com/qemu/qemu/commit/60cd23e85151525ab26591394c4e7e06fa07d216
Author: Gerd Hoffmann <kra...@redhat.com>
Date: 2017-02-01 (Wed, 01 Feb 2017)
Changed paths:
M hw/display/cirrus_vga.c
Log Message:
-----------
cirrus: fix blit address mask handling
Apply the cirrus_addr_mask to cirrus_blt_dstaddr and cirrus_blt_srcaddr
right after assigning them, in cirrus_bitblt_start(), instead of having
this all over the place in the cirrus code, and missing a few places.
Reported-by: Wolfgang Bumiller <w.bumil...@proxmox.com>
Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
Message-id: 1485338996-17095-1-git-send-email-kra...@redhat.com
Commit: 62d4c6bd5263bb8413a06c80144fc678df6dfb64
https://github.com/qemu/qemu/commit/62d4c6bd5263bb8413a06c80144fc678df6dfb64
Author: Li Qiang <liqiang...@360.cn>
Date: 2017-02-02 (Thu, 02 Feb 2017)
Changed paths:
M hw/display/cirrus_vga.c
Log Message:
-----------
cirrus: fix oob access issue (CVE-2017-2615)
When doing bitblt copy in backward mode, we should minus the
blt width first just like the adding in the forward mode. This
can avoid the oob access of the front of vga's vram.
Signed-off-by: Li Qiang <liqiang...@360.cn>
{ kraxel: with backward blits (negative pitch) addr is the topmost
address, so check it as-is against vram size ]
Cc: qemu-sta...@nongnu.org
Cc: P J P <ppan...@redhat.com>
Cc: Laszlo Ersek <ler...@redhat.com>
Cc: Paolo Bonzini <pbonz...@redhat.com>
Cc: Wolfgang Bumiller <w.bumil...@proxmox.com>
Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
Message-id: 1485938101-26602-1-git-send-email-kra...@redhat.com
Reviewed-by: Laszlo Ersek <ler...@redhat.com>
Commit: 5b66d7ae89411c01657ebfe76b9a8be346a4b1be
https://github.com/qemu/qemu/commit/5b66d7ae89411c01657ebfe76b9a8be346a4b1be
Author: Peter Maydell <peter.mayd...@linaro.org>
Date: 2017-02-03 (Fri, 03 Feb 2017)
Changed paths:
M hw/display/cirrus_vga.c
Log Message:
-----------
Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170202-2' into
staging
cirrus: multiple bugfixes, including CVE-2017-2615 fix.
# gpg: Signature made Thu 02 Feb 2017 15:03:35 GMT
# gpg: using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kra...@redhat.com>"
# gpg: aka "Gerd Hoffmann <g...@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kra...@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/pull-vga-20170202-2:
cirrus: fix oob access issue (CVE-2017-2615)
cirrus: fix blit address mask handling
cirrus: allow zero source pitch in pattern fill rops
cirrus: handle negative pitch in cirrus_invalidate_region()
Signed-off-by: Peter Maydell <peter.mayd...@linaro.org>
Compare: https://github.com/qemu/qemu/compare/5459ef3bff96...5b66d7ae8941
