af443645c3
CVE-2013-4538
s->cmd_len used as index in ssd0323_transfer() to store 32-bit field.
Possible this field might then be supplied by guest to overwrite a
return addr somewhere. Same for row/col fields, which are indicies into
framebuffer array.
To fix validate after load.
Additionally, validate that the row/col_start/end are within bounds;
otherwise the guest can provoke an overrun by either setting the _end
field so large that the row++ increments just walk off the end of the
array, or by setting the _start value to something bogus and then
letting the "we hit end of row" logic reset row to row_start.
For completeness, validate mode as well.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| Makefile.objs | ||
| ads7846.c | ||
| blizzard.c | ||
| blizzard_template.h | ||
| cirrus_vga.c | ||
| cirrus_vga_rop.h | ||
| cirrus_vga_rop2.h | ||
| cirrus_vga_template.h | ||
| exynos4210_fimd.c | ||
| framebuffer.c | ||
| framebuffer.h | ||
| g364fb.c | ||
| jazz_led.c | ||
| milkymist-tmu2.c | ||
| milkymist-vgafb.c | ||
| milkymist-vgafb_template.h | ||
| omap_dss.c | ||
| omap_lcd_template.h | ||
| omap_lcdc.c | ||
| pl110.c | ||
| pl110_template.h | ||
| pxa2xx_lcd.c | ||
| pxa2xx_template.h | ||
| qxl-logger.c | ||
| qxl-render.c | ||
| qxl.c | ||
| qxl.h | ||
| sm501.c | ||
| sm501_template.h | ||
| ssd0303.c | ||
| ssd0323.c | ||
| tc6393xb.c | ||
| tc6393xb_template.h | ||
| tcx.c | ||
| vga-isa-mm.c | ||
| vga-isa.c | ||
| vga-pci.c | ||
| vga.c | ||
| vga.h | ||
| vga_int.h | ||
| vga_template.h | ||
| vmware_vga.c | ||
| xenfb.c | ||