diff options
| author | Mauro Matteo Cascella <mcascell@redhat.com> | 2022-04-07 10:11:06 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2022-04-07 12:30:54 +0200 |
| commit | 9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895 (patch) | |
| tree | 4f8c2bc1168b262533c7cb73392ddb30aa0ce2a6 /hw/display | |
| parent | 95a3fcc7487e5bef262e1f937ed8636986764c4e (diff) | |
| download | qemu-9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895.zip qemu-9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895.tar.gz qemu-9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895.tar.bz2 | |
display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)
Avoid fetching 'width' and 'height' a second time to prevent possible
race condition. Refer to security advisory
https://starlabs.sg/advisories/22-4207/ for more information.
Fixes: CVE-2021-4207
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220407081106.343235-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/display')
| -rw-r--r-- | hw/display/qxl-render.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index d28849b..237ed29 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -266,7 +266,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor, } break; case SPICE_CURSOR_TYPE_ALPHA: - size = sizeof(uint32_t) * cursor->header.width * cursor->header.height; + size = sizeof(uint32_t) * c->width * c->height; qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id); if (qxl->debug > 2) { cursor_print_ascii_art(c, "qxl/alpha"); |