Commit 5b66d7ae authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170202-2' into staging 



cirrus: multiple bugfixes, including CVE-2017-2615 fix.

# gpg: Signature made Thu 02 Feb 2017 15:03:35 GMT
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/pull-vga-20170202-2:
  cirrus: fix oob access issue (CVE-2017-2615)
  cirrus: fix blit address mask handling
  cirrus: allow zero source pitch in pattern fill rops
  cirrus: handle negative pitch in cirrus_invalidate_region()

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents 5459ef3b 62d4c6bd

hw/display/cirrus_vga.c

+39 −25
Original line number Diff line number Diff line
@@ -272,15 +272,11 @@ static void cirrus_update_memory_access(CirrusVGAState *s); 
static bool blit_region_is_unsafe(struct CirrusVGAState *s,

                                  int32_t pitch, int32_t addr)

{

    if (!pitch) {

        return true;

    }

    if (pitch < 0) {

        int64_t min = addr

            + ((int64_t)s->cirrus_blt_height-1) * pitch;

        int32_t max = addr

            + s->cirrus_blt_width;

        if (min < 0 || max > s->vga.vram_size) {

            + ((int64_t)s->cirrus_blt_height - 1) * pitch

            - s->cirrus_blt_width;

        if (min < -1 || addr >= s->vga.vram_size) {

            return true;

        }

    } else {
@@ -294,8 +290,11 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, 
    return false;

}



static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only)

static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only,

                           bool zero_src_pitch_ok)

{

    int32_t check_pitch;



    /* should be the case, see cirrus_bitblt_start */

    assert(s->cirrus_blt_width > 0);

    assert(s->cirrus_blt_height > 0);
@@ -304,15 +303,25 @@ static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only) 
        return true;

    }



    if (!s->cirrus_blt_dstpitch) {

        return true;

    }



    if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,

                              s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {

                              s->cirrus_blt_dstaddr)) {

        return true;

    }

    if (dst_only) {

        return false;

    }

    if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,

                              s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {



    check_pitch = s->cirrus_blt_srcpitch;

    if (!zero_src_pitch_ok && !check_pitch) {

        check_pitch = s->cirrus_blt_width;

    }



    if (blit_region_is_unsafe(s, check_pitch,

                              s->cirrus_blt_srcaddr)) {

        return true;

    }
@@ -661,9 +670,14 @@ static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin, 
    int off_cur;

    int off_cur_end;



    if (off_pitch < 0) {

        off_begin -= bytesperline - 1;

    }



    for (y = 0; y < lines; y++) {

	off_cur = off_begin;

	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;

        assert(off_cur_end >= off_cur);

        memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);

	off_begin += off_pitch;

    }
@@ -674,10 +688,11 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s, 
{

    uint8_t *dst;



    dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);

    dst = s->vga.vram_ptr + s->cirrus_blt_dstaddr;



    if (blit_is_unsafe(s, false))

    if (blit_is_unsafe(s, false, true)) {

        return 0;

    }



    (*s->cirrus_rop) (s, dst, src,

                      s->cirrus_blt_dstpitch, 0,
@@ -694,11 +709,11 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) 
{

    cirrus_fill_t rop_func;



    if (blit_is_unsafe(s, true)) {

    if (blit_is_unsafe(s, true, true)) {

        return 0;

    }

    rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];

    rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),

    rop_func(s, s->vga.vram_ptr + s->cirrus_blt_dstaddr,

             s->cirrus_blt_dstpitch,

             s->cirrus_blt_width, s->cirrus_blt_height);

    cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
@@ -716,9 +731,8 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) 


static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)

{

    return cirrus_bitblt_common_patterncopy(s,

					    s->vga.vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &

                                            s->cirrus_addr_mask));

    return cirrus_bitblt_common_patterncopy(s, s->vga.vram_ptr +

                                            (s->cirrus_blt_srcaddr & ~7));

}



static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
@@ -772,10 +786,8 @@ static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) 
    if (notify)

        graphic_hw_update(s->vga.con);



    (*s->cirrus_rop) (s, s->vga.vram_ptr +

		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),

		      s->vga.vram_ptr +

		      (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),

    (*s->cirrus_rop) (s, s->vga.vram_ptr + s->cirrus_blt_dstaddr,

                      s->vga.vram_ptr + s->cirrus_blt_srcaddr,

		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,

		      s->cirrus_blt_width, s->cirrus_blt_height);
@@ -798,7 +810,7 @@ static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) 


static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)

{

    if (blit_is_unsafe(s, false))

    if (blit_is_unsafe(s, false, false))

        return 0;



    return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
@@ -826,8 +838,7 @@ static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s) 
        } else {

            /* at least one scan line */

            do {

                (*s->cirrus_rop)(s, s->vga.vram_ptr +

                                 (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),

                (*s->cirrus_rop)(s, s->vga.vram_ptr + s->cirrus_blt_dstaddr,

                                  s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);

                cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,

                                         s->cirrus_blt_width, 1);
@@ -946,6 +957,9 @@ static void cirrus_bitblt_start(CirrusVGAState * s) 
    s->cirrus_blt_modeext = s->vga.gr[0x33];

    blt_rop = s->vga.gr[0x32];



    s->cirrus_blt_dstaddr &= s->cirrus_addr_mask;

    s->cirrus_blt_srcaddr &= s->cirrus_addr_mask;



#ifdef DEBUG_BITBLT

    printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",

           blt_rop,