Re: [Qemu-devel] [PATCH] vga: fix region calculation
On 03/08/2018 07:31 AM, Gerd Hoffmann wrote: Typically the scanline length and the line offset are identical. But case they are not our calculation for region_end is incorrect. Using line_offset is fine for all scanlines, except the last one where we have to use the actual scanline length. Fixes: CVE-2018- Cc: P J PCc: Ross Lagerwall Signed-off-by: Gerd Hoffmann --- Tested-by: Ross Lagerwall Thanks! -- Ross Lagerwall
Re: [Qemu-devel] [PATCH] vga: fix region calculation
+-- On Thu, 8 Mar 2018, Gerd Hoffmann wrote --+ | Typically the scanline length and the line offset are identical. | But case But in case ... | Cc: Ross Lagerwalls/Cc:/Reported-by: Ross Lagerwall ... | Signed-off-by: Gerd Hoffmann | --- | hw/display/vga.c | 2 ++ | 1 file changed, 2 insertions(+) | | diff --git a/hw/display/vga.c b/hw/display/vga.c | index 28f298b342..72181330b8 100644 | --- a/hw/display/vga.c | +++ b/hw/display/vga.c | @@ -1483,6 +1483,8 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) | | region_start = (s->start_addr * 4); | region_end = region_start + (ram_addr_t)s->line_offset * height; | +region_end += width * s->get_bpp(s) / 8; /* scanline length */ | +region_end -= s->line_offset; | if (region_end > s->vbe_size) { | /* wraps around (can happen with cirrus vbe modes) */ | region_start = 0; It does help to fix a segmentation fault caused by OOB access. Reviewed-by: Prasad J Pandit Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
[Qemu-devel] [PATCH] vga: fix region calculation
Typically the scanline length and the line offset are identical. But case they are not our calculation for region_end is incorrect. Using line_offset is fine for all scanlines, except the last one where we have to use the actual scanline length. Fixes: CVE-2018- Cc: P J PCc: Ross Lagerwall Signed-off-by: Gerd Hoffmann --- hw/display/vga.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/display/vga.c b/hw/display/vga.c index 28f298b342..72181330b8 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1483,6 +1483,8 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) region_start = (s->start_addr * 4); region_end = region_start + (ram_addr_t)s->line_offset * height; +region_end += width * s->get_bpp(s) / 8; /* scanline length */ +region_end -= s->line_offset; if (region_end > s->vbe_size) { /* wraps around (can happen with cirrus vbe modes) */ region_start = 0; -- 2.9.3