diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2020-06-04 14:38:30 +0530 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2020-06-05 09:14:40 +0200 |
| commit | a98610c429d52db0937c1e48659428929835c455 (patch) | |
| tree | a161aed3e9c0d0163faa5413db74f6f5ac7b60aa /hw/adc/stm32f2xx_adc.c | |
| parent | 66234fee9c2d37bfbc523aa8d0ae5300a14cc10e (diff) | |
| download | focaccia-qemu-a98610c429d52db0937c1e48659428929835c455.tar.gz focaccia-qemu-a98610c429d52db0937c1e48659428929835c455.zip | |
ati-vga: check mm_index before recursive call (CVE-2020-13800)
While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Yi Ren <c4tren@gmail.com> Message-id: 20200604090830.33885-1-ppandit@redhat.com Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/adc/stm32f2xx_adc.c')
0 files changed, 0 insertions, 0 deletions