From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40972) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cWHqJ-00066A-Cj for qemu-devel@nongnu.org; Wed, 25 Jan 2017 02:18:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cWHqG-0003w2-7s for qemu-devel@nongnu.org; Wed, 25 Jan 2017 02:18:07 -0500 Received: from mx1.redhat.com ([209.132.183.28]:59160) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cWHqG-0003u6-1Y for qemu-devel@nongnu.org; Wed, 25 Jan 2017 02:18:04 -0500 Message-ID: <1485328680.29826.12.camel@redhat.com> From: Gerd Hoffmann Date: Wed, 25 Jan 2017 08:18:00 +0100 In-Reply-To: References: <58871f9b.d635240a.4cda6.5322@mx.google.com> <237b1da5-532d-afd6-84ad-6adc5bd97291@redhat.com> <1485254930.32716.23.camel@redhat.com> <1485260998.32716.45.camel@redhat.com> <20170124153143.GA29823@olga.wb> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 Subject: Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Laszlo Ersek Cc: Wolfgang Bumiller , liqiang6-s@360.cn, ghoffman@redhat.com, Li Qiang , qemu-devel@nongnu.org Hi, > > The negative pitch means (I think) that "addr" points to the lower > > left corner of the rectangle. > > > > The second part guarantees that the last blitted byte fits (lower > > right corner). >=20 > To which Gerd responded "upper left". In retrospect I don't understand > why we didn't discuss that question further, as it now seems that we > were both wrong -- "addr" stands for bottom right, in the negative pitch > case. /me looks at d3532a0db02296e687711b8cdc7791924efccea0 and I can't remember I wrote that code :-o And I can't remember the discussion either. The good thing is I probably looked more careful at the code because of that ... > Unfortunately, the original patch was meant to address the > then-embargoed CVE-2014-8106. Since we have a bug in that code (=3D a > security fix), this issue should have been reported privately as well, It has been reported privately first. I've actually suggested to send it to the public list without embargo, given that we are moving away from cirrus so this is less critical than it used to be two years ago. Cirrus isn't the default display adapter any more in qemu, since years, and management apps (virt-manager, ovirt, ...) are following. cheers, Gerd