Commit 5d2f557b authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200605-pull-request' into staging 



vga: ati security fix, cirrus cleanup.

# gpg: Signature made Fri 05 Jun 2020 12:27:13 BST
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20200605-pull-request:
  hw/display/cirrus_vga: Fix code mis-indentation
  ati-vga: check mm_index before recursive call (CVE-2020-13800)

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents b489f015 ae3887e6

hw/display/ati.c

+8 −2
Original line number Diff line number Diff line
@@ -285,8 +285,11 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size) 
            if (idx <= s->vga.vram_size - size) {

                val = ldn_le_p(s->vga.vram_ptr + idx, size);

            }

        } else {

        } else if (s->regs.mm_index > MM_DATA + 3) {

            val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size);

        } else {

            qemu_log_mask(LOG_GUEST_ERROR,

                "ati_mm_read: mm_index too small: %u\n", s->regs.mm_index);

        }

        break;

    case BIOS_0_SCRATCH ... BUS_CNTL - 1:
@@ -520,8 +523,11 @@ static void ati_mm_write(void *opaque, hwaddr addr, 
            if (idx <= s->vga.vram_size - size) {

                stn_le_p(s->vga.vram_ptr + idx, size, data);

            }

        } else {

        } else if (s->regs.mm_index > MM_DATA + 3) {

            ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size);

        } else {

            qemu_log_mask(LOG_GUEST_ERROR,

                "ati_mm_write: mm_index too small: %u\n", s->regs.mm_index);

        }

        break;

    case BIOS_0_SCRATCH ... BUS_CNTL - 1:

hw/display/cirrus_vga.c

+3 −3

File changed.

Contains only whitespace changes.