[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 1/6] vga: fix display update region calculation (spli
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 1/6] vga: fix display update region calculation (split screen) |
Date: |
Wed, 13 Sep 2017 09:41:35 +0200 |
vga display update mis-calculated the region for the dirty bitmap
snapshot in case split screen mode is used. This can trigger an
assert in cpu_physical_memory_snapshot_get_dirty().
Impact: DoS for privileged guest users.
Fixes: CVE-2017-13673
Fixes: fec5e8c92becad223df9d972770522f64aafdb72
Cc: P J P <address@hidden>
Reported-by: David Buchanan <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden
---
hw/display/vga.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/hw/display/vga.c b/hw/display/vga.c
index 3433102ef3..ad7a46563c 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -1628,9 +1628,15 @@ static void vga_draw_graphic(VGACommonState *s, int
full_update)
y1 = 0;
if (!full_update) {
+ ram_addr_t region_start = addr1;
+ ram_addr_t region_end = addr1 + line_offset * height;
vga_sync_dirty_bitmap(s);
- snap = memory_region_snapshot_and_clear_dirty(&s->vram, addr1,
- line_offset * height,
+ if (s->line_compare < height) {
+ /* split screen mode */
+ region_start = 0;
+ }
+ snap = memory_region_snapshot_and_clear_dirty(&s->vram, region_start,
+ region_end -
region_start,
DIRTY_MEMORY_VGA);
}
--
2.9.3
- [Qemu-devel] [PULL 0/6] Vga 20170913 patches, Gerd Hoffmann, 2017/09/13
- [Qemu-devel] [PULL 1/6] vga: fix display update region calculation (split screen),
Gerd Hoffmann <=
- [Qemu-devel] [PULL 4/6] qxl: add support for chunked cursors., Gerd Hoffmann, 2017/09/13
- [Qemu-devel] [PULL 6/6] virtio-gpu: don't clear QemuUIInfo information on reset, Gerd Hoffmann, 2017/09/13
- [Qemu-devel] [PULL 2/6] vga: stop passing pointers to vga_draw_line* functions, Gerd Hoffmann, 2017/09/13
- [Qemu-devel] [PULL 3/6] qxl: drop mono cursor support, Gerd Hoffmann, 2017/09/13
- [Qemu-devel] [PULL 5/6] vga/migration: Update memory map in post_load, Gerd Hoffmann, 2017/09/13
- Re: [Qemu-devel] [PULL 0/6] Vga 20170913 patches, Peter Maydell, 2017/09/14