falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
qemu-irix/hw/display
History
Gerd Hoffmann 9c7714afd7 vga: handle cirrus vbe mode wraparounds. 
Commit "3d90c62548 vga: stop passing pointers to vga_draw_line*
functions" is incomplete.  It doesn't handle the case that the vga
rendering code tries to create a shared surface, i.e. a pixman image
backed by vga video memory.  That can not work in case the guest display
wraps from end of video memory to the start.  So force shadowing in that
case.  Also adjust the snapshot region calculation.

Can trigger with cirrus only, when programming vbe modes using the bochs
api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds
can't happen.

Fixes: CVE-2017-13672
Fixes: 3d90c62548
Cc: P J P <ppandit@redhat.com>
Reported-by: David Buchanan <d@vidbuchanan.co.uk>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010141323.14049-3-kraxel@redhat.com
(cherry picked from commit 28f77de26a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
 		2017-12-06 13:01:53 -06:00
..
Makefile.objs add opengl_cflags to QEMU_CFLAGS 2017-03-21 10:25:01 +00:00
ads7846.c ssi: change ssi_slave_init to be a realize ops 2016-07-04 13:15:22 +01:00
bcm2835_fb.c hw: explicitly include qemu/log.h 2016-05-19 16:42:29 +02:00
blizzard.c hw/display/blizzard: Remove blizzard_template.h 2016-05-12 13:22:30 +01:00
cg3.c hw: Use new memory_region_init_{ram, rom, rom_device}() functions 2017-07-14 17:59:42 +01:00
cirrus_vga.c cirrus: stop passing around src pointers in the blitter 2017-03-16 08:58:16 +01:00
cirrus_vga_rop.h cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16 2017-03-17 10:23:44 +01:00
cirrus_vga_rop2.h cirrus: fix PUTPIXEL macro 2017-03-27 12:14:45 +02:00
dpcd.c aux: Rename aux.[ch] to auxbus.[ch] for the benefit of Windows 2016-07-07 13:47:01 +01:00
exynos4210_fimd.c exynos: make display updates thread safe 2017-04-24 10:12:28 +02:00
framebuffer.c framebuffer: make display updates thread safe 2017-04-24 10:12:28 +02:00
framebuffer.h framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer 2015-07-24 13:57:45 +02:00
g364fb.c g364fb: make display updates thread safe 2017-04-24 10:12:28 +02:00
jazz_led.c jazz_led: fix bad snprintf 2017-05-10 10:19:24 +03:00
milkymist-tmu2.c lm32: milkymist-tmu2: fix a third integer overflow 2017-02-28 09:03:39 +03:00
milkymist-vgafb.c milkymist: update specification URLs 2016-06-20 18:12:04 +02:00
milkymist-vgafb_template.h
…
omap_dss.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
omap_lcd_template.h omap_lcdc: Remove support for DEPTH != 32 2016-05-12 13:22:24 +01:00
omap_lcdc.c omap_lcdc: Remove support for DEPTH != 32 2016-05-12 13:22:24 +01:00
pl110.c hw/display: QOM'ify pl110.c 2016-10-24 16:26:56 +01:00
pl110_template.h
…
pxa2xx_lcd.c arm: Clean up includes 2016-01-29 15:07:23 +00:00
pxa2xx_template.h
…
qxl-logger.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
qxl-render.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
qxl.c qxl: call qemu_spice_display_init_common for secondary devices 2017-08-15 15:04:51 +01:00
qxl.h qxl: add xres and yres properties 2017-04-24 10:12:28 +02:00
sm501.c hw/display/sm501: Don't use vmstate_register_ram_global() 2017-07-25 13:04:28 +01:00
sm501_template.h sm501: Misc clean ups 2017-04-24 12:32:12 +01:00
ssd0303.c i2c: Allow I2C devices to NAK start events 2017-01-09 11:40:20 +00:00
ssd0323.c vmstateify ssd0323 display 2016-09-22 18:13:08 +01:00
tc6393xb.c hw: Use new memory_region_init_{ram, rom, rom_device}() functions 2017-07-14 17:59:42 +01:00
tc6393xb_template.h
…
tcx.c memory: Rename memory_region_init_ram() to memory_region_init_ram_nomigrate() 2017-07-14 17:59:42 +01:00
trace-events trace-events: fix code style: print 0x before hex numbers 2017-08-01 12:13:07 +01:00
vga-helpers.h vga: stop passing pointers to vga_draw_line* functions 2017-09-22 18:11:23 -05:00
vga-isa-mm.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
vga-isa.c portio: keep references on portio 2016-09-08 18:05:21 +04:00
vga-pci.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
vga.c vga: handle cirrus vbe mode wraparounds. 2017-12-06 13:01:53 -06:00
vga.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
vga_int.h vga: stop passing pointers to vga_draw_line* functions 2017-09-22 18:11:23 -05:00
virtio-gpu-3d.c virtio-gpu: move virtio_gpu_gl_block 2017-05-12 12:02:48 +02:00
virtio-gpu-pci.c virtio-gpu-pci: tag as not hotpluggable 2016-09-13 09:26:58 +02:00
virtio-gpu.c virtio-gpu: skip update cursor in post_load if we don't have one 2017-07-17 11:41:23 +02:00
virtio-vga.c virtio: rename the bar index field name in VirtIOPCIProxy 2016-10-08 11:25:29 +03:00
vmware_vga.c hw: Use new memory_region_init_{ram, rom, rom_device}() functions 2017-07-14 17:59:42 +01:00
xenfb.c xenfb: remove xen_init_display "temporary" hack 2017-07-07 11:10:03 -07:00
xlnx_dp.c qom: enforce readonly nature of link's check callback 2017-07-14 12:04:42 +02:00