motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-07 01:33:56 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)

Browse source 
Prevent potential integer overflow by limiting 'width' and 'height' to
512x512. Also change 'datasize' type to size_t. Refer to security
advisory https://starlabs.sg/advisories/22-4206/ for more information.

Fixes: CVE-2021-4206
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Mauro Matteo Cascella 2022-04-07 10:17:12 +02:00 • committed by Gerd Hoffmann
parent 9569f5cb5b
commit fa892e9abb
3 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
hw/display/qxl-render.c
View file

@ -247,6 +247,13 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
size_t size;
c = cursor_alloc(cursor->header.width, cursor->header.height);
if (!c) {
qxl_set_guest_bug(qxl, "%s: cursor %ux%u alloc error", __func__,
cursor->header.width, cursor->header.height);
goto fail;
}
c->hot_x = cursor->header.hot_spot_x;
c->hot_y = cursor->header.hot_spot_y;
switch (cursor->header.type) {

2
hw/display/vmware_vga.c
View file

@ -515,6 +515,8 @@ static inline void vmsvga_cursor_define(struct vmsvga_state_s *s,
int i, pixels;
qc = cursor_alloc(c->width, c->height);
assert(qc != NULL);
qc->hot_x = c->hot_x;
qc->hot_y = c->hot_y;
switch (c->bpp) {