diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2022-04-08 10:43:30 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2022-04-08 10:43:30 +0100 |
| commit | dde8689d1fe82e295a278ba4bf1abd9be5c7bcab (patch) | |
| tree | 2e3db9e407e4559f313700a8912e431cf96a5880 /hw/display | |
| parent | 95a3fcc7487e5bef262e1f937ed8636986764c4e (diff) | |
| parent | fa892e9abb728e76afcf27323ab29c57fb0fe7aa (diff) | |
| download | focaccia-qemu-dde8689d1fe82e295a278ba4bf1abd9be5c7bcab.tar.gz focaccia-qemu-dde8689d1fe82e295a278ba4bf1abd9be5c7bcab.zip | |
Merge tag 'fixes-20220408-pull-request' of git://git.kraxel.org/qemu into staging
two cursor/qxl related security fixes. # gpg: Signature made Fri 08 Apr 2022 05:37:16 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'fixes-20220408-pull-request' of git://git.kraxel.org/qemu: ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/display')
| -rw-r--r-- | hw/display/qxl-render.c | 9 | ||||
| -rw-r--r-- | hw/display/vmware_vga.c | 2 |
2 files changed, 10 insertions, 1 deletions
diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index d28849b121..ca217004bf 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -247,6 +247,13 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor, size_t size; c = cursor_alloc(cursor->header.width, cursor->header.height); + + if (!c) { + qxl_set_guest_bug(qxl, "%s: cursor %ux%u alloc error", __func__, + cursor->header.width, cursor->header.height); + goto fail; + } + c->hot_x = cursor->header.hot_spot_x; c->hot_y = cursor->header.hot_spot_y; switch (cursor->header.type) { @@ -266,7 +273,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor, } break; case SPICE_CURSOR_TYPE_ALPHA: - size = sizeof(uint32_t) * cursor->header.width * cursor->header.height; + size = sizeof(uint32_t) * c->width * c->height; qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id); if (qxl->debug > 2) { cursor_print_ascii_art(c, "qxl/alpha"); diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c index 98c83474ad..45d06cbe25 100644 --- a/hw/display/vmware_vga.c +++ b/hw/display/vmware_vga.c @@ -515,6 +515,8 @@ static inline void vmsvga_cursor_define(struct vmsvga_state_s *s, int i, pixels; qc = cursor_alloc(c->width, c->height); + assert(qc != NULL); + qc->hot_x = c->hot_x; qc->hot_y = c->hot_y; switch (c->bpp) { |