gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-08-01 23:28:08 -07:00
Code Issues Projects Releases Wiki Activity

app-emulation/qemu: apply fix for CVE-2016-7170, bug #593284

Browse Source 
Package-Manager: portage-2.2.28
This commit is contained in:
Matthias Maier
2016-09-09 21:23:22 -05:00
parent 18f904c5fc
commit eaeffb27d6
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
app-emulation/qemu/files/qemu-2.7.0-CVE-2016-7170.patch Normal file
View File

@@ -0,0 +1,40 @@
From: Prasad J Pandit <address@hidden>
When processing svga command DEFINE_CURSOR in vmsvga_fifo_run,
the computed BITMAP and PIXMAP size are checked against the
'cursor.mask[]' and 'cursor.image[]' array sizes in bytes.
Correct these checks to avoid OOB memory access.
Reported-by: Qinghao Tang <address@hidden>
Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
hw/display/vmware_vga.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index e51a05e..6599cf0 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -676,11 +676,13 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
cursor.bpp = vmsvga_fifo_read(s);
args = SVGA_BITMAP_SIZE(x, y) + SVGA_PIXMAP_SIZE(x, y, cursor.bpp);
- if (cursor.width > 256 ||
- cursor.height > 256 ||
- cursor.bpp > 32 ||
- SVGA_BITMAP_SIZE(x, y) > sizeof cursor.mask ||
- SVGA_PIXMAP_SIZE(x, y, cursor.bpp) > sizeof cursor.image) {
+ if (cursor.width > 256
+ || cursor.height > 256
+ || cursor.bpp > 32
+ || SVGA_BITMAP_SIZE(x, y)
+ > sizeof(cursor.mask) / sizeof(cursor.mask[0])
+ || SVGA_PIXMAP_SIZE(x, y, cursor.bpp)
+ > sizeof(cursor.image) / sizeof(cursor.image[0])) {
goto badcmd;
}
--
2.5.5

1
app-emulation/qemu/qemu-2.7.0-r1.ebuild → app-emulation/qemu/qemu-2.7.0-r2.ebuild
View File

@@ -340,6 +340,7 @@ src_prepare() {
epatch "${FILESDIR}"/${P}-CVE-2016-7156.patch # bug 593036
epatch "${FILESDIR}"/${P}-CVE-2016-7157-1.patch # bug 593038
epatch "${FILESDIR}"/${P}-CVE-2016-7157-2.patch # bug 593038
epatch "${FILESDIR}"/${P}-CVE-2016-7170.patch # bug 593284
# Fix ld and objcopy being called directly
tc-export AR LD OBJCOPY