Update version for v2.2.0 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Update version for v2.2.0-rc5 release
2014-12-09 12:13:37 +00:00 · 2014-12-04 15:51:22 +00:00 · 2014-12-04 12:22:46 +00:00 · 2014-12-01 10:25:46 +01:00 · 2014-12-01 10:25:12 +01:00
2 changed files with 49 additions and 18 deletions
--- a/2
+++ b/2
@@ -1 +1 @@
-2.1.94
+2.2.0
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -173,20 +173,6 @@

 #define CIRRUS_PNPMMIO_SIZE         0x1000

-#define BLTUNSAFE(s) \
-    ( \
-        ( /* check dst is within bounds */ \
-            (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \
-                + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
-                    (s)->vga.vram_size \
-        ) || \
-        ( /* check src is within bounds */ \
-            (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \
-                + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
-                    (s)->vga.vram_size \
-        ) \
-    )
-
 struct CirrusVGAState;
 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
                                     uint8_t * dst, const uint8_t * src,
@@ -279,6 +265,50 @@ static void cirrus_update_memory_access(CirrusVGAState *s);
 *
 ***************************************/

+static bool blit_region_is_unsafe(struct CirrusVGAState *s,
+                                  int32_t pitch, int32_t addr)
+{
+    if (pitch < 0) {
+        int64_t min = addr
+            + ((int64_t)s->cirrus_blt_height-1) * pitch;
+        int32_t max = addr
+            + s->cirrus_blt_width;
+        if (min < 0 || max >= s->vga.vram_size) {
+            return true;
+        }
+    } else {
+        int64_t max = addr
+            + ((int64_t)s->cirrus_blt_height-1) * pitch
+            + s->cirrus_blt_width;
+        if (max >= s->vga.vram_size) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static bool blit_is_unsafe(struct CirrusVGAState *s)
+{
+    /* should be the case, see cirrus_bitblt_start */
+    assert(s->cirrus_blt_width > 0);
+    assert(s->cirrus_blt_height > 0);
+
+    if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
+        return true;
+    }
+
+    if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
+                              s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {
+        return true;
+    }
+    if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
+                              s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {
+        return true;
+    }
+
+    return false;
+}
+
 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
                                  uint8_t *dst,const uint8_t *src,
                                  int dstpitch,int srcpitch,
@@ -636,7 +666,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,

    dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);

-    if (BLTUNSAFE(s))
+    if (blit_is_unsafe(s))
        return 0;

    (*s->cirrus_rop) (s, dst, src,
@@ -654,8 +684,9 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
 {
    cirrus_fill_t rop_func;

-    if (BLTUNSAFE(s))
+    if (blit_is_unsafe(s)) {
        return 0;
+    }
    rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
    rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
             s->cirrus_blt_dstpitch,
@@ -752,7 +783,7 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)

 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
 {
-    if (BLTUNSAFE(s))
+    if (blit_is_unsafe(s))
        return 0;

    cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
Author	SHA1	Message	Date
Peter Maydell	45e1611de8	Update version for v2.2.0 release Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2014-12-09 12:13:37 +00:00
Peter Maydell	d00e6cddc2	Update version for v2.2.0-rc5 release Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2014-12-04 15:51:22 +00:00
Peter Maydell	54f3a180a3	Merge remote-tracking branch 'remotes/kraxel/tags/pull-cve-2014-8106-20141204-1' into staging cirrus: fix blit region check # gpg: Signature made Thu 04 Dec 2014 11:54:57 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-cve-2014-8106-20141204-1: cirrus: don't overflow CirrusVGAState->cirrus_bltbuf cirrus: fix blit region check Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2014-12-04 12:22:46 +00:00
Gerd Hoffmann	bf25983345	cirrus: don't overflow CirrusVGAState->cirrus_bltbuf This is CVE-2014-8106. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>	2014-12-01 10:25:46 +01:00
Gerd Hoffmann	d3532a0db0	cirrus: fix blit region check Issues: * Doesn't check pitches correctly in case it is negative. * Doesn't check width at all. Turn macro into functions while being at it, also factor out the check for one region which we then can simply call twice for src + dst. This is CVE-2014-8106. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>	2014-12-01 10:25:12 +01:00
@@ -1 +1 @@
 .1.94
 .2.0