1369de9828
CVE-2014-3689 vmware_vga: insufficient parameter validation in rectangle functions (bz #1153038, bz #1153035)
80 lines
2.9 KiB
Diff
80 lines
2.9 KiB
Diff
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Tue, 26 Aug 2014 14:16:30 +0200
|
|
Subject: [PATCH] vbe: make bochs dispi interface return the correct memory
|
|
size with qxl
|
|
|
|
VgaState->vram_size is the size of the pci bar. In case of qxl not the
|
|
whole pci bar can be used as vga framebuffer. Add a new variable
|
|
vbe_size to handle that case. By default (if unset) it equals
|
|
vram_size, but qxl can set vbe_size to something else.
|
|
|
|
This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results
|
|
and sanity checks are done with the correct size too.
|
|
|
|
Cc: qemu-stable@nongnu.org
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
(cherry picked from commit 54a85d462447c1cb8a1638578a7fd086350b4d2d)
|
|
---
|
|
hw/display/qxl.c | 1 +
|
|
hw/display/vga.c | 7 +++++--
|
|
hw/display/vga_int.h | 1 +
|
|
3 files changed, 7 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
|
|
index 7ef3eff..31035f5 100644
|
|
--- a/hw/display/qxl.c
|
|
+++ b/hw/display/qxl.c
|
|
@@ -2067,6 +2067,7 @@ static int qxl_init_primary(PCIDevice *dev)
|
|
|
|
qxl->id = 0;
|
|
qxl_init_ramsize(qxl);
|
|
+ vga->vbe_size = qxl->vgamem_size;
|
|
vga->vram_size_mb = qxl->vga.vram_size >> 20;
|
|
vga_common_init(vga, OBJECT(dev));
|
|
vga_init(vga, OBJECT(dev),
|
|
diff --git a/hw/display/vga.c b/hw/display/vga.c
|
|
index 06f44a8..2f13e43 100644
|
|
--- a/hw/display/vga.c
|
|
+++ b/hw/display/vga.c
|
|
@@ -614,7 +614,7 @@ uint32_t vbe_ioport_read_data(void *opaque, uint32_t addr)
|
|
val = s->vbe_regs[s->vbe_index];
|
|
}
|
|
} else if (s->vbe_index == VBE_DISPI_INDEX_VIDEO_MEMORY_64K) {
|
|
- val = s->vram_size / (64 * 1024);
|
|
+ val = s->vbe_size / (64 * 1024);
|
|
} else {
|
|
val = 0;
|
|
}
|
|
@@ -753,7 +753,7 @@ void vbe_ioport_write_data(void *opaque, uint32_t addr, uint32_t val)
|
|
line_offset = w >> 1;
|
|
else
|
|
line_offset = w * ((s->vbe_regs[VBE_DISPI_INDEX_BPP] + 7) >> 3);
|
|
- h = s->vram_size / line_offset;
|
|
+ h = s->vbe_size / line_offset;
|
|
/* XXX: support weird bochs semantics ? */
|
|
if (h < s->vbe_regs[VBE_DISPI_INDEX_YRES])
|
|
return;
|
|
@@ -2291,6 +2291,9 @@ void vga_common_init(VGACommonState *s, Object *obj)
|
|
s->vram_size <<= 1;
|
|
}
|
|
s->vram_size_mb = s->vram_size >> 20;
|
|
+ if (!s->vbe_size) {
|
|
+ s->vbe_size = s->vram_size;
|
|
+ }
|
|
|
|
s->is_vbe_vmstate = 1;
|
|
memory_region_init_ram(&s->vram, obj, "vga.vram", s->vram_size);
|
|
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
|
|
index e641890..999567c 100644
|
|
--- a/hw/display/vga_int.h
|
|
+++ b/hw/display/vga_int.h
|
|
@@ -93,6 +93,7 @@ typedef struct VGACommonState {
|
|
MemoryRegion vram_vbe;
|
|
uint32_t vram_size;
|
|
uint32_t vram_size_mb; /* property */
|
|
+ uint32_t vbe_size;
|
|
uint32_t latch;
|
|
MemoryRegion *chain4_alias;
|
|
uint8_t sr_index;
|