diff options
| author | Philippe Mathieu-Daudé <f4bug@amsat.org> | 2020-05-23 21:15:16 +0200 |
|---|---|---|
| committer | Helge Deller <deller@gmx.de> | 2020-08-26 23:04:00 +0200 |
| commit | 84a7b7741a62ede8ff01ae151e59b2a16bda629b (patch) | |
| tree | 2c9c8824dc15b04e1570ca99eca82b89cd32e2ef /linux-user/linux_loop.h | |
| parent | b87a7355de04a2771c11824ea791802c052c979c (diff) | |
| download | focaccia-qemu-84a7b7741a62ede8ff01ae151e59b2a16bda629b.tar.gz focaccia-qemu-84a7b7741a62ede8ff01ae151e59b2a16bda629b.zip | |
hw/display/artist: Refactor artist_rop8() to avoid buffer over-run
Invalid I/O writes can craft an offset out of the vram_buffer range. Instead of passing an unsafe pointer to artist_rop8(), pass the vram_buffer and the offset. We can now check if the offset is in range before accessing it. We avoid: Program terminated with signal SIGSEGV, Segmentation fault. 284 *dst &= ~plane_mask; (gdb) bt #0 0x000056367b2085c0 in artist_rop8 (s=0x56367d38b510, dst=0x7f9f972fffff <error: Cannot access memory at address 0x7f9f972fffff>, val=0 '\000') at hw/display/artist.c:284 #1 0x000056367b209325 in draw_line (s=0x56367d38b510, x1=-20480, y1=-1, x2=0, y2=17920, update_start=true, skip_pix=-1, max_pix=-1) at hw/display/artist.c:646 Reported-by: LLVM libFuzzer Buglink: https://bugs.launchpad.net/qemu/+bug/1880326 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Helge Deller <deller@gmx.de>
Diffstat (limited to 'linux-user/linux_loop.h')
0 files changed, 0 insertions, 0 deletions