From patchwork Tue Oct 17 08:24:59 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 826834 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yGSvL34Gzz9t16 for ; Tue, 17 Oct 2017 19:26:06 +1100 (AEDT) Received: from localhost ([::1]:37169 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e4NCO-0002uI-Hk for incoming@patchwork.ozlabs.org; Tue, 17 Oct 2017 04:26:04 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59445) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e4NBY-0002ct-Q9 for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e4NBV-00060d-MA for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37946) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e4NBV-0005ys-Fr for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:09 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id E2ABF7E438 for ; Tue, 17 Oct 2017 08:25:07 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com E2ABF7E438 Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=kraxel@redhat.com Received: from sirius.home.kraxel.org (ovpn-116-239.ams2.redhat.com [10.36.116.239]) by smtp.corp.redhat.com (Postfix) with ESMTP id C33E460852; Tue, 17 Oct 2017 08:25:04 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id BA33E4FD69; Tue, 17 Oct 2017 10:25:02 +0200 (CEST) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Tue, 17 Oct 2017 10:24:59 +0200 Message-Id: <20171017082502.7885-2-kraxel@redhat.com> In-Reply-To: <20171017082502.7885-1-kraxel@redhat.com> References: <20171017082502.7885-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Tue, 17 Oct 2017 08:25:08 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 1/4] vga: drop line_offset variable X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" Signed-off-by: Gerd Hoffmann --- hw/display/vga.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index ed24ef7076..bf774e3402 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1464,7 +1464,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) { DisplaySurface *surface = qemu_console_surface(s->con); int y1, y, update, linesize, y_start, double_scan, mask, depth; - int width, height, shift_control, line_offset, bwidth, bits; + int width, height, shift_control, bwidth, bits; ram_addr_t page0, page1; DirtyBitmapSnapshot *snap = NULL; int disp_width, multi_scan, multi_run; @@ -1614,7 +1614,6 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) s->cursor_invalidate(s); } - line_offset = s->line_offset; #if 0 printf("w=%d h=%d v=%d line_offset=%d cr[0x09]=0x%02x cr[0x17]=0x%02x linecmp=%d sr[0x01]=0x%02x\n", width, height, v, line_offset, s->cr[9], s->cr[VGA_CRTC_MODE], @@ -1629,7 +1628,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) if (!full_update) { ram_addr_t region_start = addr1; - ram_addr_t region_end = addr1 + line_offset * height; + ram_addr_t region_end = addr1 + s->line_offset * height; vga_sync_dirty_bitmap(s); if (s->line_compare < height) { /* split screen mode */ @@ -1681,7 +1680,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) if (!multi_run) { mask = (s->cr[VGA_CRTC_MODE] & 3) ^ 3; if ((y1 & mask) == mask) - addr1 += line_offset; + addr1 += s->line_offset; y1++; multi_run = multi_scan; } else { From patchwork Tue Oct 17 08:25:00 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 826835 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yGSxB6fWDz9s4q for ; Tue, 17 Oct 2017 19:27:42 +1100 (AEDT) Received: from localhost ([::1]:37172 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e4NDx-00046n-1Q for incoming@patchwork.ozlabs.org; Tue, 17 Oct 2017 04:27:41 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59446) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e4NBY-0002cu-QL for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e4NBW-00061d-Fo for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37990) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e4NBW-00060X-7A for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:10 -0400 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 47A9D81127 for ; Tue, 17 Oct 2017 08:25:09 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 47A9D81127 Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=kraxel@redhat.com Received: from sirius.home.kraxel.org (ovpn-116-239.ams2.redhat.com [10.36.116.239]) by smtp.corp.redhat.com (Postfix) with ESMTP id C48B864437; Tue, 17 Oct 2017 08:25:04 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id C1FE54FD6B; Tue, 17 Oct 2017 10:25:02 +0200 (CEST) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Tue, 17 Oct 2017 10:25:00 +0200 Message-Id: <20171017082502.7885-3-kraxel@redhat.com> In-Reply-To: <20171017082502.7885-1-kraxel@redhat.com> References: <20171017082502.7885-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Tue, 17 Oct 2017 08:25:09 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 2/4] vga: handle cirrus vbe mode wraparounds. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann , P J P Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" Commit "3d90c62548 vga: stop passing pointers to vga_draw_line* functions" is incomplete. It doesn't handle the case that the vga rendering code tries to create a shared surface, i.e. a pixman image backed by vga video memory. That can not work in case the guest display wraps from end of video memory to the start. So force shadowing in that case. Also adjust the snapshot region calculation. Can trigger with cirrus only, when programming vbe modes using the bochs api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds can't happen. Fixes: CVE-2017-13672 Fixes: 3d90c6254863693a6b13d918d2b8682e08bbc681 Cc: P J P Reported-by: David Buchanan Signed-off-by: Gerd Hoffmann Message-id: 20171010141323.14049-3-kraxel@redhat.com --- hw/display/vga.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index bf774e3402..1afceb6f16 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1465,13 +1465,13 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) DisplaySurface *surface = qemu_console_surface(s->con); int y1, y, update, linesize, y_start, double_scan, mask, depth; int width, height, shift_control, bwidth, bits; - ram_addr_t page0, page1; + ram_addr_t page0, page1, region_start, region_end; DirtyBitmapSnapshot *snap = NULL; int disp_width, multi_scan, multi_run; uint8_t *d; uint32_t v, addr1, addr; vga_draw_line_func *vga_draw_line = NULL; - bool share_surface; + bool share_surface, force_shadow = false; pixman_format_code_t format; #ifdef HOST_WORDS_BIGENDIAN bool byteswap = !s->big_endian_fb; @@ -1484,6 +1484,15 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) s->get_resolution(s, &width, &height); disp_width = width; + region_start = (s->start_addr * 4); + region_end = region_start + s->line_offset * height; + if (region_end > s->vbe_size) { + /* wraps around (can happen with cirrus vbe modes) */ + region_start = 0; + region_end = s->vbe_size; + force_shadow = true; + } + shift_control = (s->gr[VGA_GFX_MODE] >> 5) & 3; double_scan = (s->cr[VGA_CRTC_MAX_SCAN] >> 7); if (shift_control != 1) { @@ -1523,7 +1532,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) format = qemu_default_pixman_format(depth, !byteswap); if (format) { share_surface = dpy_gfx_check_format(s->con, format) - && !s->force_shadow; + && !s->force_shadow && !force_shadow; } else { share_surface = false; } @@ -1627,8 +1636,6 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) y1 = 0; if (!full_update) { - ram_addr_t region_start = addr1; - ram_addr_t region_end = addr1 + s->line_offset * height; vga_sync_dirty_bitmap(s); if (s->line_compare < height) { /* split screen mode */ @@ -1651,10 +1658,17 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) addr = (addr & ~0x8000) | ((y1 & 2) << 14); } update = full_update; - page0 = addr; - page1 = addr + bwidth - 1; + page0 = addr & s->vbe_size_mask; + page1 = (addr + bwidth - 1) & s->vbe_size_mask; if (full_update) { update = 1; + } else if (page1 < page0) { + /* scanline wraps from end of video memory to the start */ + assert(force_shadow); + update = memory_region_snapshot_get_dirty(&s->vram, snap, + page0, 0); + update |= memory_region_snapshot_get_dirty(&s->vram, snap, + page1, 0); } else { update = memory_region_snapshot_get_dirty(&s->vram, snap, page0, page1 - page0); From patchwork Tue Oct 17 08:25:01 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 826838 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yGT0s6xP6z9sDB for ; Tue, 17 Oct 2017 19:30:52 +1100 (AEDT) Received: from localhost ([::1]:37185 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e4NH0-0006Iz-6t for incoming@patchwork.ozlabs.org; Tue, 17 Oct 2017 04:30:50 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59497) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e4NBb-0002hT-LU for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e4NBV-00060p-Qi for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34112) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e4NBV-0005zi-KX for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:09 -0400 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B91501F57C for ; Tue, 17 Oct 2017 08:25:08 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com B91501F57C Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=kraxel@redhat.com Received: from sirius.home.kraxel.org (ovpn-116-239.ams2.redhat.com [10.36.116.239]) by smtp.corp.redhat.com (Postfix) with ESMTP id C1E846443D; Tue, 17 Oct 2017 08:25:04 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id C9C913F10B; Tue, 17 Oct 2017 10:25:02 +0200 (CEST) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Tue, 17 Oct 2017 10:25:01 +0200 Message-Id: <20171017082502.7885-4-kraxel@redhat.com> In-Reply-To: <20171017082502.7885-1-kraxel@redhat.com> References: <20171017082502.7885-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 17 Oct 2017 08:25:08 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 3/4] vga: add ram_addr_t cast X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" Reported by Coverity. Fixes: CID 1381409 Signed-off-by: Gerd Hoffmann Message-id: 20171010141323.14049-4-kraxel@redhat.com --- hw/display/vga.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index 1afceb6f16..1d19f6bc48 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1485,7 +1485,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) disp_width = width; region_start = (s->start_addr * 4); - region_end = region_start + s->line_offset * height; + region_end = region_start + (ram_addr_t)s->line_offset * height; if (region_end > s->vbe_size) { /* wraps around (can happen with cirrus vbe modes) */ region_start = 0; From patchwork Tue Oct 17 08:25:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 826833 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yGSv41xFPz9t16 for ; Tue, 17 Oct 2017 19:25:51 +1100 (AEDT) Received: from localhost ([::1]:37167 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e4NC8-0002iR-CA for incoming@patchwork.ozlabs.org; Tue, 17 Oct 2017 04:25:48 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59478) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e4NBa-0002dW-0W for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e4NBV-00060P-GG for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:13 -0400 Received: from mx1.redhat.com ([209.132.183.28]:36100) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e4NBV-0005yO-9r for qemu-devel@nongnu.org; Tue, 17 Oct 2017 04:25:09 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 88F79C0587C6; Tue, 17 Oct 2017 08:25:07 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 88F79C0587C6 Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=kraxel@redhat.com Received: from sirius.home.kraxel.org (ovpn-116-239.ams2.redhat.com [10.36.116.239]) by smtp.corp.redhat.com (Postfix) with ESMTP id B9B095C3FF; Tue, 17 Oct 2017 08:25:04 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id D1AA240559; Tue, 17 Oct 2017 10:25:02 +0200 (CEST) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Tue, 17 Oct 2017 10:25:02 +0200 Message-Id: <20171017082502.7885-5-kraxel@redhat.com> In-Reply-To: <20171017082502.7885-1-kraxel@redhat.com> References: <20171017082502.7885-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Tue, 17 Oct 2017 08:25:07 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 4/4] cirrus: fix oob access in mode4and5 write functions X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann , Prasad J Pandit Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" Move dst calculation into the loop, so we apply the mask on each interation and will not overflow vga memory. Cc: Prasad J Pandit Reported-by: Niu Guoxiang Signed-off-by: Gerd Hoffmann Message-id: 20171011084314.21752-1-kraxel@redhat.com --- hw/display/cirrus_vga.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c index b4d579857a..bc32bf1e39 100644 --- a/hw/display/cirrus_vga.c +++ b/hw/display/cirrus_vga.c @@ -2038,15 +2038,14 @@ static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s, unsigned val = mem_value; uint8_t *dst; - dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask); for (x = 0; x < 8; x++) { + dst = s->vga.vram_ptr + ((offset + x) & s->cirrus_addr_mask); if (val & 0x80) { *dst = s->cirrus_shadow_gr1; } else if (mode == 5) { *dst = s->cirrus_shadow_gr0; } val <<= 1; - dst++; } memory_region_set_dirty(&s->vga.vram, offset, 8); } @@ -2060,8 +2059,8 @@ static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s, unsigned val = mem_value; uint8_t *dst; - dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask); for (x = 0; x < 8; x++) { + dst = s->vga.vram_ptr + ((offset + 2 * x) & s->cirrus_addr_mask & ~1); if (val & 0x80) { *dst = s->cirrus_shadow_gr1; *(dst + 1) = s->vga.gr[0x11]; @@ -2070,7 +2069,6 @@ static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s, *(dst + 1) = s->vga.gr[0x10]; } val <<= 1; - dst += 2; } memory_region_set_dirty(&s->vga.vram, offset, 16); }