Re: [PATCH v2 4/4] hw/display/artist.c: fix out of bounds check

[Helge Deller]

On 03.08.20 21:10, Alexander Bulekov wrote:
> On 200803 1432, Alexander Bulekov wrote:
>> On 200803 1336, Alexander Bulekov wrote:
>>> Hi,
>>> I applied this patch, but I can still trigger a segfault and heap
>>> overread through artist_reg_write -> fill_window. I dont know if these
>>> problems are related to what this patch fixes. If not, let me know and
>>> I can create a separate launchpad report for these.
>>
>> And another one through draw_line...
>> cat << EOF | ./hppa-softmmu/qemu-system-hppa -display none \
>> -qtest stdio -accel qtest
>> writeq 0xf8100e02 0x4f4f4f4f4f939600
>> EOF
>
> I missed that Phil already submitted a report here:
> https://bugs.launchpad.net/qemu/+bug/1880326
>
> and sent a patchset
> https://patchwork.ozlabs.org/project/qemu-devel/list/?series=178879

Alexander, thanks for finding the bugs, and, Phil, thanks for the patches!

I'll test & review it tomorrow and add into the pull request if Ok.

Helge


>
>> ==13563==ERROR: AddressSanitizer: SEGV on unknown address 0x7f3fe4d403fd (pc 
>> 0x55ae401eb392 bp 0x7ffea90ca2d0 sp 0x7ffea90ca1e0 T0)
>> ==13563==The signal is caused by a READ memory access.
>>     #0 0x55ae401eb392 in artist_rop8 /hw/display/artist.c:284:14
...