|
 |
1be5c7 |
From 87a318f0b8758f940a316831a77b6ebebca42b19 Mon Sep 17 00:00:00 2001
|
|
|
1be5c7 |
From: Jon Maloy <jmaloy@redhat.com>
|
|
|
1be5c7 |
Date: Wed, 4 May 2022 10:35:17 -0400
|
|
|
1be5c7 |
Subject: [PATCH 3/3] ui/cursor: fix integer overflow in cursor_alloc
|
|
|
1be5c7 |
(CVE-2021-4206)
|
|
|
1be5c7 |
MIME-Version: 1.0
|
|
|
1be5c7 |
Content-Type: text/plain; charset=UTF-8
|
|
|
1be5c7 |
Content-Transfer-Encoding: 8bit
|
|
|
1be5c7 |
|
|
|
1be5c7 |
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
|
1be5c7 |
RH-MergeRequest: 180: ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)
|
|
|
1be5c7 |
RH-Commit: [1/1] 7ad711347bc6248dc5aefa45401ca74448dee5e5 (jmaloy/qemu-kvm)
|
|
|
1be5c7 |
RH-Bugzilla: 2040734
|
|
|
1be5c7 |
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
|
1be5c7 |
RH-Acked-by: Mauro Matteo Cascella <None>
|
|
|
1be5c7 |
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
1be5c7 |
|
|
|
1be5c7 |
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2040734
|
|
|
1be5c7 |
Upstream: Merged
|
|
|
1be5c7 |
CVE: CVE-2021-4206
|
|
|
1be5c7 |
|
|
|
1be5c7 |
commit fa892e9abb728e76afcf27323ab29c57fb0fe7aa
|
|
|
1be5c7 |
Author: Mauro Matteo Cascella <mcascell@redhat.com>
|
|
|
1be5c7 |
Date: Thu Apr 7 10:17:12 2022 +0200
|
|
|
1be5c7 |
|
|
|
1be5c7 |
ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)
|
|
|
1be5c7 |
|
|
|
1be5c7 |
Prevent potential integer overflow by limiting 'width' and 'height' to
|
|
|
1be5c7 |
512x512. Also change 'datasize' type to size_t. Refer to security
|
|
|
1be5c7 |
advisory https://starlabs.sg/advisories/22-4206/ for more information.
|
|
|
1be5c7 |
|
|
|
1be5c7 |
Fixes: CVE-2021-4206
|
|
|
1be5c7 |
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
|
|
|
1be5c7 |
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
1be5c7 |
Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
|
|
|
1be5c7 |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
1be5c7 |
|
|
|
1be5c7 |
(cherry picked from commit fa892e9abb728e76afcf27323ab29c57fb0fe7aa)
|
|
|
1be5c7 |
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
|
1be5c7 |
---
|
|
|
1be5c7 |
hw/display/qxl-render.c | 7 +++++++
|
|
|
1be5c7 |
hw/display/vmware_vga.c | 2 ++
|
|
|
1be5c7 |
ui/cursor.c | 8 +++++++-
|
|
|
1be5c7 |
3 files changed, 16 insertions(+), 1 deletion(-)
|
|
|
1be5c7 |
|
|
|
1be5c7 |
diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
|
|
|
1be5c7 |
index 237ed293ba..ca217004bf 100644
|
|
|
1be5c7 |
--- a/hw/display/qxl-render.c
|
|
|
1be5c7 |
+++ b/hw/display/qxl-render.c
|
|
|
1be5c7 |
@@ -247,6 +247,13 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
|
|
|
1be5c7 |
size_t size;
|
|
|
1be5c7 |
|
|
|
1be5c7 |
c = cursor_alloc(cursor->header.width, cursor->header.height);
|
|
|
1be5c7 |
+
|
|
|
1be5c7 |
+ if (!c) {
|
|
|
1be5c7 |
+ qxl_set_guest_bug(qxl, "%s: cursor %ux%u alloc error", __func__,
|
|
|
1be5c7 |
+ cursor->header.width, cursor->header.height);
|
|
|
1be5c7 |
+ goto fail;
|
|
|
1be5c7 |
+ }
|
|
|
1be5c7 |
+
|
|
|
1be5c7 |
c->hot_x = cursor->header.hot_spot_x;
|
|
|
1be5c7 |
c->hot_y = cursor->header.hot_spot_y;
|
|
|
1be5c7 |
switch (cursor->header.type) {
|
|
|
1be5c7 |
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
|
|
|
1be5c7 |
index e2969a6c81..2b81d6122f 100644
|
|
|
1be5c7 |
--- a/hw/display/vmware_vga.c
|
|
|
1be5c7 |
+++ b/hw/display/vmware_vga.c
|
|
|
1be5c7 |
@@ -509,6 +509,8 @@ static inline void vmsvga_cursor_define(struct vmsvga_state_s *s,
|
|
|
1be5c7 |
int i, pixels;
|
|
|
1be5c7 |
|
|
|
1be5c7 |
qc = cursor_alloc(c->width, c->height);
|
|
|
1be5c7 |
+ assert(qc != NULL);
|
|
|
1be5c7 |
+
|
|
|
1be5c7 |
qc->hot_x = c->hot_x;
|
|
|
1be5c7 |
qc->hot_y = c->hot_y;
|
|
|
1be5c7 |
switch (c->bpp) {
|
|
|
1be5c7 |
diff --git a/ui/cursor.c b/ui/cursor.c
|
|
|
1be5c7 |
index 1d62ddd4d0..835f0802f9 100644
|
|
|
1be5c7 |
--- a/ui/cursor.c
|
|
|
1be5c7 |
+++ b/ui/cursor.c
|
|
|
1be5c7 |
@@ -46,6 +46,8 @@ static QEMUCursor *cursor_parse_xpm(const char *xpm[])
|
|
|
1be5c7 |
|
|
|
1be5c7 |
/* parse pixel data */
|
|
|
1be5c7 |
c = cursor_alloc(width, height);
|
|
|
1be5c7 |
+ assert(c != NULL);
|
|
|
1be5c7 |
+
|
|
|
1be5c7 |
for (pixel = 0, y = 0; y < height; y++, line++) {
|
|
|
1be5c7 |
for (x = 0; x < height; x++, pixel++) {
|
|
|
1be5c7 |
idx = xpm[line][x];
|
|
|
1be5c7 |
@@ -91,7 +93,11 @@ QEMUCursor *cursor_builtin_left_ptr(void)
|
|
|
1be5c7 |
QEMUCursor *cursor_alloc(int width, int height)
|
|
|
1be5c7 |
{
|
|
|
1be5c7 |
QEMUCursor *c;
|
|
|
1be5c7 |
- int datasize = width * height * sizeof(uint32_t);
|
|
|
1be5c7 |
+ size_t datasize = width * height * sizeof(uint32_t);
|
|
|
1be5c7 |
+
|
|
|
1be5c7 |
+ if (width > 512 || height > 512) {
|
|
|
1be5c7 |
+ return NULL;
|
|
|
1be5c7 |
+ }
|
|
|
1be5c7 |
|
|
|
1be5c7 |
c = g_malloc0(sizeof(QEMUCursor) + datasize);
|
|
|
1be5c7 |
c->width = width;
|
|
|
1be5c7 |
--
|
|
|
1be5c7 |
2.35.1
|
|
|
1be5c7 |
|