[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 27/56] vmsvga: add more fifo checks
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 27/56] vmsvga: add more fifo checks |
Date: |
Mon, 8 Aug 2016 16:03:58 -0500 |
From: Gerd Hoffmann <address@hidden>
Make sure all fifo ptrs are within range.
Fixes: CVE-2016-4454
Cc: address@hidden
Cc: P J P <address@hidden>
Reported-by: 李强 <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden
(cherry picked from commit c2e3c54d3960bc53bfa3a5ce7ea7a050b9be267e)
Signed-off-by: Michael Roth <address@hidden>
---
hw/display/vmware_vga.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 63a7c05..a26e62e 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -563,7 +563,10 @@ static inline int vmsvga_fifo_length(struct vmsvga_state_s
*s)
if (CMD(min) < (uint8_t *) s->cmd->fifo - (uint8_t *) s->fifo) {
return 0;
}
- if (CMD(max) > SVGA_FIFO_SIZE) {
+ if (CMD(max) > SVGA_FIFO_SIZE ||
+ CMD(min) >= SVGA_FIFO_SIZE ||
+ CMD(stop) >= SVGA_FIFO_SIZE ||
+ CMD(next_cmd) >= SVGA_FIFO_SIZE) {
return 0;
}
if (CMD(max) < CMD(min) + 10 * 1024) {
--
1.9.1
- [Qemu-devel] [PATCH 13/56] esp: check command buffer length before write(CVE-2016-4439), (continued)
- [Qemu-devel] [PATCH 13/56] esp: check command buffer length before write(CVE-2016-4439), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 15/56] block/nfs: refuse readahead if cache.direct is on, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 16/56] usb/ohci: Fix crash with when specifying too many num-ports, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 17/56] vga: add sr_vbe register set, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 14/56] esp: check dma length before reading scsi command(CVE-2016-4441), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 22/56] Fix configure test for PBKDF2 in nettle, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 18/56] vfio: Fix broken EEH, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 20/56] nbd: Don't trim unrequested bytes, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 01/56] i386: kvmvapic: initialise imm32 variable, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 19/56] block/iscsi: avoid potential overflow of acb->task->cdb, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 27/56] vmsvga: add more fifo checks,
Michael Roth <=
- [Qemu-devel] [PATCH 21/56] savevm: fail if migration blockers are present, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 24/56] scsi: mptsas: infinite loop while fetching requests, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 30/56] io: remove mistaken call to object_ref on QTask, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 23/56] scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 29/56] vmsvga: don't process more than 1024 fifo commands at once, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 31/56] ui: fix regression in printing VNC host/port on startup, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 32/56] net: fix qemu_announce_self not emitting packets, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 25/56] block: Drop bdrv_ioctl_bh_cb, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 26/56] vmsvga: move fifo sanity checks to vmsvga_fifo_length, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 02/56] spice/gl: add & use qemu_spice_gl_monitor_config, Michael Roth, 2016/08/08