[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 3/6] vmsvga: add more fifo checks
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 3/6] vmsvga: add more fifo checks |
Date: |
Fri, 3 Jun 2016 09:34:40 +0200 |
Make sure all fifo ptrs are within range.
Fixes: CVE-2016-4454
Cc: P J P <address@hidden>
Reported-by: 李强 <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden
---
hw/display/vmware_vga.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 63a7c05..a26e62e 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -563,7 +563,10 @@ static inline int vmsvga_fifo_length(struct vmsvga_state_s
*s)
if (CMD(min) < (uint8_t *) s->cmd->fifo - (uint8_t *) s->fifo) {
return 0;
}
- if (CMD(max) > SVGA_FIFO_SIZE) {
+ if (CMD(max) > SVGA_FIFO_SIZE ||
+ CMD(min) >= SVGA_FIFO_SIZE ||
+ CMD(stop) >= SVGA_FIFO_SIZE ||
+ CMD(next_cmd) >= SVGA_FIFO_SIZE) {
return 0;
}
if (CMD(max) < CMD(min) + 10 * 1024) {
--
1.8.3.1
- [Qemu-devel] [PULL 0/6] vga patch queue, Gerd Hoffmann, 2016/06/03
- [Qemu-devel] [PULL 3/6] vmsvga: add more fifo checks,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 1/6] virtio-gpu: fix scanout rectangles, Gerd Hoffmann, 2016/06/03
- [Qemu-devel] [PULL 5/6] vmsvga: don't process more than 1024 fifo commands at once, Gerd Hoffmann, 2016/06/03
- [Qemu-devel] [PULL 6/6] virtio-gpu: add live migration support, Gerd Hoffmann, 2016/06/03
- [Qemu-devel] [PULL 4/6] vmsvga: shadow fifo registers, Gerd Hoffmann, 2016/06/03
- [Qemu-devel] [PULL 2/6] vmsvga: move fifo sanity checks to vmsvga_fifo_length, Gerd Hoffmann, 2016/06/03
- Re: [Qemu-devel] [PULL 0/6] vga patch queue, Peter Maydell, 2016/06/03