On 02/01/17 09:35, Gerd Hoffmann wrote: > From: Li Qiang <[email protected]> > > When doing bitblt copy in backward mode, we should minus the > blt width first just like the adding in the forward mode. This > can avoid the oob access of the front of vga's vram. > > Signed-off-by: Li Qiang <[email protected]> > Message-id: [email protected] > > { kraxel: with backward blits (negative pitch) addr is the topmost > address, so check it as-is against vram size ] > > Cc: [email protected] > Cc: P J P <[email protected]> > Cc: Laszlo Ersek <[email protected]> > Cc: Paolo Bonzini <[email protected]> > Cc: Wolfgang Bumiller <[email protected]> > Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106) > Signed-off-by: Gerd Hoffmann <[email protected]> > --- > hw/display/cirrus_vga.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) > > diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c > index 95873ae..3961712 100644 > --- a/hw/display/cirrus_vga.c > +++ b/hw/display/cirrus_vga.c > @@ -277,10 +277,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState > *s, > } > if (pitch < 0) { > int64_t min = addr > - + ((int64_t)s->cirrus_blt_height-1) * pitch; > - int32_t max = addr > - + s->cirrus_blt_width; > - if (min < 0 || max > s->vga.vram_size) { > + + ((int64_t)s->cirrus_blt_height - 1) * pitch > + - s->cirrus_blt_width; > + if (min < -1 || addr >= s->vga.vram_size) { > return true; > } > } else { >
Famous last words: Reviewed-by: Laszlo Ersek <[email protected]> Thanks Laszlo
