aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorMauro Matteo Cascella <mcascell@redhat.com>2022-04-07 10:17:12 +0200
committerGerd Hoffmann <kraxel@redhat.com>2022-04-07 12:30:54 +0200
commitfa892e9abb728e76afcf27323ab29c57fb0fe7aa (patch)
tree2e3db9e407e4559f313700a8912e431cf96a5880 /hw
parent9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895 (diff)
downloadqemu-fa892e9abb728e76afcf27323ab29c57fb0fe7aa.zip
qemu-fa892e9abb728e76afcf27323ab29c57fb0fe7aa.tar.gz
qemu-fa892e9abb728e76afcf27323ab29c57fb0fe7aa.tar.bz2
ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)
Prevent potential integer overflow by limiting 'width' and 'height' to 512x512. Also change 'datasize' type to size_t. Refer to security advisory https://starlabs.sg/advisories/22-4206/ for more information. Fixes: CVE-2021-4206 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081712.345609-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/display/qxl-render.c7
-rw-r--r--hw/display/vmware_vga.c2
2 files changed, 9 insertions, 0 deletions
diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
index 237ed29..ca21700 100644
--- a/hw/display/qxl-render.c
+++ b/hw/display/qxl-render.c
@@ -247,6 +247,13 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
size_t size;
c = cursor_alloc(cursor->header.width, cursor->header.height);
+
+ if (!c) {
+ qxl_set_guest_bug(qxl, "%s: cursor %ux%u alloc error", __func__,
+ cursor->header.width, cursor->header.height);
+ goto fail;
+ }
+
c->hot_x = cursor->header.hot_spot_x;
c->hot_y = cursor->header.hot_spot_y;
switch (cursor->header.type) {
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 98c8347..45d06cb 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -515,6 +515,8 @@ static inline void vmsvga_cursor_define(struct vmsvga_state_s *s,
int i, pixels;
qc = cursor_alloc(c->width, c->height);
+ assert(qc != NULL);
+
qc->hot_x = c->hot_x;
qc->hot_y = c->hot_y;
switch (c->bpp) {