packages/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!143 Automatically generate code patches with openeuler

Browse Source 
From: @zhendongchen
Reviewed-by: @yorifang
Signed-off-by: @yorifang
This commit is contained in:
openeuler-ci-bot 2020-11-27 13:53:43 +08:00 committed by Gitee
commit af718a86b7
2 changed files with 58 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
ati-check-x-y-display-parameter-values.patch Normal file
View File

@ -0,0 +1,53 @@
From e80d8d7f805e07ba6f012423739e83553ea024ef Mon Sep 17 00:00:00 2001
From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Wed, 18 Nov 2020 10:22:32 +0800
Subject: [PATCH] ati: check x y display parameter values
fix CVE-2020-24352
The source and destination x,y display parameters in ati_2d_blt()
may run off the vga limits if either of s->regs.[src|dst]_[xy] is
zero. Check the parameter values to avoid potential crash.
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20201021103818.1704030-1-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
cherry-pick from commit ca1f9cbfdce4d63b10d57de80fef89a89d92a540
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
---
hw/display/ati_2d.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
index 23a8ae0cd8..4dc10ea795 100644
--- a/hw/display/ati_2d.c
+++ b/hw/display/ati_2d.c
@@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s)
dst_stride *= bpp;
}
uint8_t *end = s->vga.vram_ptr + s->vga.vram_size;
- if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) *
- dst_stride >= end) {
+ if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end
+ || dst_bits + dst_x
+ + (dst_y + s->regs.dst_height) * dst_stride >= end) {
qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
return;
}
@@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s)
src_bits += s->regs.crtc_offset & 0x07ffffff;
src_stride *= bpp;
}
- if (src_bits >= end || src_bits + src_x +
- (src_y + s->regs.dst_height) * src_stride >= end) {
+ if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end
+ || src_bits + src_x
+ + (src_y + s->regs.dst_height) * src_stride >= end) {
qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
return;
}
--
2.27.0

6
qemu.spec
View File

@ -1,6 +1,6 @@
Name: qemu Name: qemu
Version: 4.1.0 Version: 4.1.0
Release: 24 Release: 25
Epoch: 2 Epoch: 2
Summary: QEMU is a generic and open source machine emulator and virtualizer Summary: QEMU is a generic and open source machine emulator and virtualizer
License: GPLv2 and BSD and MIT and CC-BY License: GPLv2 and BSD and MIT and CC-BY
@ -222,6 +222,7 @@ Patch0209: target-arm-ignore-evtstrm-and-cpuid-CPU-features.patch
Patch0210: target-arm-Update-the-ID-registers-of-Kunpeng-920.patch Patch0210: target-arm-Update-the-ID-registers-of-Kunpeng-920.patch
Patch0211: target-arm-only-set-ID_PFR1_EL1.GIC-for-AArch32-gues.patch Patch0211: target-arm-only-set-ID_PFR1_EL1.GIC-for-AArch32-gues.patch
Patch0212: target-arm-clear-EL2-and-EL3-only-when-kvm-is-not-en.patch Patch0212: target-arm-clear-EL2-and-EL3-only-when-kvm-is-not-en.patch
Patch0213: ati-check-x-y-display-parameter-values.patch
BuildRequires: flex BuildRequires: flex
BuildRequires: bison BuildRequires: bison
@ -567,6 +568,9 @@ getent passwd qemu >/dev/null || \
%endif %endif
%changelog %changelog
* Wed Nov 18 2020 Huawei Technologies Co., Ltd <alex.chen@huawei.com>
- ati: check x y display parameter values
* Mon Sep 21 2020 Huawei Technologies Co., Ltd <alex.chen@huawei.com> * Mon Sep 21 2020 Huawei Technologies Co., Ltd <alex.chen@huawei.com>
- target/arm: Add isar_feature tests for PAN + ATS1E1 - target/arm: Add isar_feature tests for PAN + ATS1E1
- target/arm: Add ID_AA64MMFR2_EL1 - target/arm: Add ID_AA64MMFR2_EL1