8c721a87ae
- Remove deprecated patch "work-around-SA_RESTART-race" (boo#982208) - Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-2.6 * Patches dropped: 0002-XXX-work-around-SA_RESTART-race-wit.patch 0003-qemu-0.9.0.cvs-binfmt.patch 0004-qemu-cvs-alsa_bitfield.patch 0005-qemu-cvs-alsa_ioctl.patch 0006-qemu-cvs-alsa_mmap.patch 0007-qemu-cvs-gettimeofday.patch 0008-qemu-cvs-ioctl_debug.patch 0009-qemu-cvs-ioctl_nodirection.patch 0010-block-vmdk-Support-creation-of-SCSI.patch 0011-linux-user-add-binfmt-wrapper-for-a.patch 0012-PPC-KVM-Disable-mmu-notifier-check.patch 0013-linux-user-fix-segfault-deadlock.patch 0014-linux-user-binfmt-support-host-bina.patch 0015-linux-user-Ignore-broken-loop-ioctl.patch 0016-linux-user-lock-tcg.patch 0017-linux-user-Run-multi-threaded-code-.patch 0018-linux-user-lock-tb-flushing-too.patch 0019-linux-user-Fake-proc-cpuinfo.patch 0020-linux-user-implement-FS_IOC_GETFLAG.patch 0021-linux-user-implement-FS_IOC_SETFLAG.patch 0022-linux-user-XXX-disable-fiemap.patch 0023-slirp-nooutgoing.patch 0024-vnc-password-file-and-incoming-conn.patch 0025-linux-user-add-more-blk-ioctls.patch 0026-linux-user-use-target_ulong.patch 0027-block-Add-support-for-DictZip-enabl.patch 0028-block-Add-tar-container-format.patch OBS-URL: https://build.opensuse.org/request/show/408549 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=305
74 lines
2.5 KiB
Diff
74 lines
2.5 KiB
Diff
From 74a7469799521413262d7571b7092f859ed32121 Mon Sep 17 00:00:00 2001
|
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Mon, 30 May 2016 09:09:18 +0200
|
|
Subject: [PATCH] vmsvga: move fifo sanity checks to vmsvga_fifo_length
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Sanity checks are applied when the fifo is enabled by the guest
|
|
(SVGA_REG_CONFIG_DONE write). Which doesn't help much if the guest
|
|
changes the fifo registers afterwards. Move the checks to
|
|
vmsvga_fifo_length so they are done each time qemu is about to read
|
|
from the fifo.
|
|
|
|
Fixes: CVE-2016-4454
|
|
Cc: qemu-stable@nongnu.org
|
|
Cc: P J P <ppandit@redhat.com>
|
|
Reported-by: 李强 <liqiang6-s@360.cn>
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Message-id: 1464592161-18348-2-git-send-email-kraxel@redhat.com
|
|
(cherry picked from commit 521360267876d3b6518b328051a2e56bca55bef8)
|
|
[BR: CVE-2016-4454 BSC#982222]
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
hw/display/vmware_vga.c | 28 +++++++++++++++-------------
|
|
1 file changed, 15 insertions(+), 13 deletions(-)
|
|
|
|
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
|
|
index 0c63fa8..63a7c05 100644
|
|
--- a/hw/display/vmware_vga.c
|
|
+++ b/hw/display/vmware_vga.c
|
|
@@ -555,6 +555,21 @@ static inline int vmsvga_fifo_length(struct vmsvga_state_s *s)
|
|
if (!s->config || !s->enable) {
|
|
return 0;
|
|
}
|
|
+
|
|
+ /* Check range and alignment. */
|
|
+ if ((CMD(min) | CMD(max) | CMD(next_cmd) | CMD(stop)) & 3) {
|
|
+ return 0;
|
|
+ }
|
|
+ if (CMD(min) < (uint8_t *) s->cmd->fifo - (uint8_t *) s->fifo) {
|
|
+ return 0;
|
|
+ }
|
|
+ if (CMD(max) > SVGA_FIFO_SIZE) {
|
|
+ return 0;
|
|
+ }
|
|
+ if (CMD(max) < CMD(min) + 10 * 1024) {
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
num = CMD(next_cmd) - CMD(stop);
|
|
if (num < 0) {
|
|
num += CMD(max) - CMD(min);
|
|
@@ -1005,19 +1020,6 @@ static void vmsvga_value_write(void *opaque, uint32_t address, uint32_t value)
|
|
case SVGA_REG_CONFIG_DONE:
|
|
if (value) {
|
|
s->fifo = (uint32_t *) s->fifo_ptr;
|
|
- /* Check range and alignment. */
|
|
- if ((CMD(min) | CMD(max) | CMD(next_cmd) | CMD(stop)) & 3) {
|
|
- break;
|
|
- }
|
|
- if (CMD(min) < (uint8_t *) s->cmd->fifo - (uint8_t *) s->fifo) {
|
|
- break;
|
|
- }
|
|
- if (CMD(max) > SVGA_FIFO_SIZE) {
|
|
- break;
|
|
- }
|
|
- if (CMD(max) < CMD(min) + 10 * 1024) {
|
|
- break;
|
|
- }
|
|
vga_dirty_log_stop(&s->vga);
|
|
}
|
|
s->config = !!value;
|