* [PATCH v2] ati: check x y display parameter values
@ 2020-10-21 10:38 P J P
2020-11-03 13:53 ` Gerd Hoffmann
0 siblings, 1 reply; 2+ messages in thread
From: P J P @ 2020-10-21 10:38 UTC (permalink / raw)
To: BALATON Zoltan
Cc: Prasad J Pandit, Gaoning Pan, Gerd Hoffmann, QEMU Developers
From: Prasad J Pandit <pjp@fedoraproject.org>
The source and destination x,y display parameters in ati_2d_blt()
may run off the vga limits if either of s->regs.[src|dst]_[xy] is
zero. Check the parameter values to avoid potential crash.
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/display/ati_2d.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
Update v2: add [dst|src]_[xy] > 0x3fff check
-> https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg05698.html
diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
index 23a8ae0cd8..4dc10ea795 100644
--- a/hw/display/ati_2d.c
+++ b/hw/display/ati_2d.c
@@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s)
dst_stride *= bpp;
}
uint8_t *end = s->vga.vram_ptr + s->vga.vram_size;
- if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) *
- dst_stride >= end) {
+ if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end
+ || dst_bits + dst_x
+ + (dst_y + s->regs.dst_height) * dst_stride >= end) {
qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
return;
}
@@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s)
src_bits += s->regs.crtc_offset & 0x07ffffff;
src_stride *= bpp;
}
- if (src_bits >= end || src_bits + src_x +
- (src_y + s->regs.dst_height) * src_stride >= end) {
+ if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end
+ || src_bits + src_x
+ + (src_y + s->regs.dst_height) * src_stride >= end) {
qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
return;
}
--
2.26.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] ati: check x y display parameter values
2020-10-21 10:38 [PATCH v2] ati: check x y display parameter values P J P
@ 2020-11-03 13:53 ` Gerd Hoffmann
0 siblings, 0 replies; 2+ messages in thread
From: Gerd Hoffmann @ 2020-11-03 13:53 UTC (permalink / raw)
To: P J P; +Cc: Prasad J Pandit, Gaoning Pan, QEMU Developers
On Wed, Oct 21, 2020 at 04:08:18PM +0530, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> The source and destination x,y display parameters in ati_2d_blt()
> may run off the vga limits if either of s->regs.[src|dst]_[xy] is
> zero. Check the parameter values to avoid potential crash.
>
> Reported-by: Gaoning Pan <pgn@zju.edu.cn>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
> hw/display/ati_2d.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
Added to fixes queue.
thanks,
Gerd
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-11-03 13:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-21 10:38 [PATCH v2] ati: check x y display parameter values P J P
2020-11-03 13:53 ` Gerd Hoffmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).