falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

virtio-gpu: check early scanout id 

Before accessing the g->scanout array, in order to avoid potential
out-of-bounds access.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1463653560-26958-2-git-send-email-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Marc-André Lureau 2016-05-19 12:25:55 +02:00 committed by Gerd Hoffmann
parent e081c24d30
commit fe89fdebca
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
hw/display/virtio-gpu.c
View File

@ -508,6 +508,14 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id, trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id,
ss.r.width, ss.r.height, ss.r.x, ss.r.y); ss.r.width, ss.r.height, ss.r.x, ss.r.y);
if (ss.scanout_id >= VIRTIO_GPU_MAX_SCANOUT ||
ss.scanout_id >= g->conf.max_outputs) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d",
__func__, ss.scanout_id);
cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
return;
}
g->enable = 1; g->enable = 1;
if (ss.resource_id == 0) { if (ss.resource_id == 0) {
scanout = &g->scanout[ss.scanout_id]; scanout = &g->scanout[ss.scanout_id];
@ -517,8 +525,7 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
res->scanout_bitmask &= ~(1 << ss.scanout_id); res->scanout_bitmask &= ~(1 << ss.scanout_id);
} }
} }
if (ss.scanout_id == 0 || if (ss.scanout_id == 0) {
ss.scanout_id >= g->conf.max_outputs) {
qemu_log_mask(LOG_GUEST_ERROR, qemu_log_mask(LOG_GUEST_ERROR,
"%s: illegal scanout id specified %d", "%s: illegal scanout id specified %d",
__func__, ss.scanout_id); __func__, ss.scanout_id);
@ -533,14 +540,6 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
} }
/* create a surface for this scanout */ /* create a surface for this scanout */
if (ss.scanout_id >= VIRTIO_GPU_MAX_SCANOUT ||
ss.scanout_id >= g->conf.max_outputs) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d",
__func__, ss.scanout_id);
cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
return;
}
res = virtio_gpu_find_resource(g, ss.resource_id); res = virtio_gpu_find_resource(g, ss.resource_id);
if (!res) { if (!res) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n", qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n",