[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface
From: |
Laszlo Ersek |
Subject: |
Re: [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface |
Date: |
Wed, 22 Apr 2020 18:53:18 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 |
On 04/22/20 12:02, Gerd Hoffmann wrote:
> Signed-off-by: Gerd Hoffmann <address@hidden>
> ---
> hw/display/ramfb.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c
> index fbe959147dc9..d1b1cb9bb294 100644
> --- a/hw/display/ramfb.c
> +++ b/hw/display/ramfb.c
> @@ -15,6 +15,7 @@
> #include "qapi/error.h"
> #include "hw/loader.h"
> #include "hw/display/ramfb.h"
> +#include "hw/display/bochs-vbe.h" /* for limits */
> #include "ui/console.h"
> #include "sysemu/reset.h"
>
> @@ -49,6 +50,11 @@ static DisplaySurface *ramfb_create_display_surface(int
> width, int height,
> hwaddr size;
> void *data;
>
> + if (width < 16 || width > VBE_DISPI_MAX_XRES ||
> + height < 16 || height > VBE_DISPI_MAX_YRES ||
Seems to make sense (I've checked the constants).
> + format == 0 /* unknown format */)
OK, this is from qemu_drm_format_to_pixman().
> + return NULL;
> +
> if (linesize == 0) {
> linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
> }
>
I would suggest four more sanity checks:
- if "linesize" is nonzero, make sure it is a whole multiple of the
required word size (?)
- if "linesize" is nonzero, make sure it is not bogus with relation to
"width". I'm thinking something like:
if (linesize > 0) {
min_linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
if (linesize < min_linesize) {
return NULL;
}
}
May not be the best way to put it, but you get the idea.
- We might want to put an upper bound on "linesize" too. I realize
"(hwaddr)linesize * height" should be safe in this function, as the
multiplication is done in uint64_t. But we also pass "linesize" to
qemu_create_displaysurface_from(), and who knows how it is used for
multiplication there.
- in the ramfb_create_display_surface() function, we should change the
type of the parameters "width", "height", and "linesize", from "int" to
"uint32_t". In ramfb_fw_cfg_write(), we do take them as uint32_t from
the guest, but then pass them as "int"s. And so the current state can
produce negative values for any of "width", "height", and "linesize" --
and I'd rather not investigate where those lead. (The new checks catch a
negative "width" and "height" already, but not "linesize".) Casting a
negative "linesize" to (hwaddr) produces a big, ugly value, FWIW.
Thanks
Laszlo
- [PATCH 0/5] ramfb: a bunch of reverts and fixes, Gerd Hoffmann, 2020/04/22
- [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface, Gerd Hoffmann, 2020/04/22
- Re: [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface,
Laszlo Ersek <=
- Re: [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface, Gerd Hoffmann, 2020/04/23
- Re: [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface, Laszlo Ersek, 2020/04/24
- Re: [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface, Gerd Hoffmann, 2020/04/27
- Re: [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface, Laszlo Ersek, 2020/04/28
- Re: [PATCH 4/5] ramfb: add sanity checks to ramfb_create_display_surface, Gerd Hoffmann, 2020/04/29
[PATCH 3/5] ramfb: don't update RAMFBState on errors, Gerd Hoffmann, 2020/04/22
[PATCH 2/5] Revert "hw/display/ramfb: lock guest resolution after it's set", Gerd Hoffmann, 2020/04/22