[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/6] virtio-gpu: check early scanout id
From: |
marcandre . lureau |
Subject: |
[Qemu-devel] [PATCH 1/6] virtio-gpu: check early scanout id |
Date: |
Thu, 19 May 2016 12:25:55 +0200 |
From: Marc-André Lureau <address@hidden>
Before accessing the g->scanout array, in order to avoid potential
out-of-bounds access.
Signed-off-by: Marc-André Lureau <address@hidden>
---
hw/display/virtio-gpu.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index c181fb3..1193838 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -507,6 +507,14 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id,
ss.r.width, ss.r.height, ss.r.x, ss.r.y);
+ if (ss.scanout_id >= VIRTIO_GPU_MAX_SCANOUT ||
+ ss.scanout_id >= g->conf.max_outputs) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d",
+ __func__, ss.scanout_id);
+ cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
+ return;
+ }
+
g->enable = 1;
if (ss.resource_id == 0) {
scanout = &g->scanout[ss.scanout_id];
@@ -516,8 +524,7 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
res->scanout_bitmask &= ~(1 << ss.scanout_id);
}
}
- if (ss.scanout_id == 0 ||
- ss.scanout_id >= g->conf.max_outputs) {
+ if (ss.scanout_id == 0) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: illegal scanout id specified %d",
__func__, ss.scanout_id);
@@ -532,14 +539,6 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
}
/* create a surface for this scanout */
- if (ss.scanout_id >= VIRTIO_GPU_MAX_SCANOUT ||
- ss.scanout_id >= g->conf.max_outputs) {
- qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d",
- __func__, ss.scanout_id);
- cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
- return;
- }
-
res = virtio_gpu_find_resource(g, ss.resource_id);
if (!res) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n",
--
2.7.4
- [Qemu-devel] [PATCH 0/6] virtio-gpu: scanout limit fixes, marcandre . lureau, 2016/05/19
- [Qemu-devel] [PATCH 2/6] virtio-vga: propagate on gpu realized error, marcandre . lureau, 2016/05/19
- [Qemu-devel] [PATCH 4/6] virtio-gpu: check max_outputs only, marcandre . lureau, 2016/05/19
- [Qemu-devel] [PATCH 6/6] virtio-gpu: fix ui idx check, marcandre . lureau, 2016/05/19
- [Qemu-devel] [PATCH 3/6] virtio-gpu: check max_outputs value, marcandre . lureau, 2016/05/19
- [Qemu-devel] [PATCH 1/6] virtio-gpu: check early scanout id,
marcandre . lureau <=
- [Qemu-devel] [PATCH 5/6] virtio-gpu: use VIRTIO_GPU_MAX_SCANOUTS, marcandre . lureau, 2016/05/19
- Re: [Qemu-devel] [PATCH 0/6] virtio-gpu: scanout limit fixes, Gerd Hoffmann, 2016/05/20