[Qemu-commits] [qemu/qemu] d3532a: cirrus: fix blit region check

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: d3532a0db02296e687711b8cdc7791924efccea0
      
https://github.com/qemu/qemu/commit/d3532a0db02296e687711b8cdc7791924efccea0
  Author: Gerd Hoffmann <address@hidden>
  Date:   2014-12-01 (Mon, 01 Dec 2014)

  Changed paths:
    M hw/display/cirrus_vga.c

  Log Message:
  -----------
  cirrus: fix blit region check

Issues:
 * Doesn't check pitches correctly in case it is negative.
 * Doesn't check width at all.

Turn macro into functions while being at it, also factor out the check
for one region which we then can simply call twice for src + dst.

This is CVE-2014-8106.

Reported-by: Paolo Bonzini <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Paolo Bonzini <address@hidden>


  Commit: bf25983345ca44aec3dd92c57142be45452bd38a
      
https://github.com/qemu/qemu/commit/bf25983345ca44aec3dd92c57142be45452bd38a
  Author: Gerd Hoffmann <address@hidden>
  Date:   2014-12-01 (Mon, 01 Dec 2014)

  Changed paths:
    M hw/display/cirrus_vga.c

  Log Message:
  -----------
  cirrus: don't overflow CirrusVGAState->cirrus_bltbuf

This is CVE-2014-8106.

Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 54f3a180a3d0b334c55d0f61d6e9fe5c7c6d42d5
      
https://github.com/qemu/qemu/commit/54f3a180a3d0b334c55d0f61d6e9fe5c7c6d42d5
  Author: Peter Maydell <address@hidden>
  Date:   2014-12-04 (Thu, 04 Dec 2014)

  Changed paths:
    M hw/display/cirrus_vga.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/kraxel/tags/pull-cve-2014-8106-20141204-1' into staging

cirrus: fix blit region check

# gpg: Signature made Thu 04 Dec 2014 11:54:57 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <address@hidden>"
# gpg:                 aka "Gerd Hoffmann <address@hidden>"
# gpg:                 aka "Gerd Hoffmann (private) <address@hidden>"

* remotes/kraxel/tags/pull-cve-2014-8106-20141204-1:
  cirrus: don't overflow CirrusVGAState->cirrus_bltbuf
  cirrus: fix blit region check

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/0d7954c288e9...54f3a180a3d0