diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2020-06-04 14:38:30 +0530 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2020-06-22 12:15:00 -0500 |
| commit | 69a6048e1ef24a65da45a0c6802ace95066f0f37 (patch) | |
| tree | 175e7de23fb8a7ba0b76e798b8cdf5053334396b /qapi/qobject-output-visitor.c | |
| parent | 01392ae31a38294c1771eeed0dada1e224493492 (diff) | |
| download | qemu-69a6048e1ef24a65da45a0c6802ace95066f0f37.zip qemu-69a6048e1ef24a65da45a0c6802ace95066f0f37.tar.gz qemu-69a6048e1ef24a65da45a0c6802ace95066f0f37.tar.bz2 | |
ati-vga: check mm_index before recursive call (CVE-2020-13800)
While accessing VGA registers via ati_mm_read/write routines,
a guest may set 's->regs.mm_index' such that it leads to infinite
recursion. Check mm_index value to avoid such recursion. Log an
error message for wrong values.
Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Yi Ren <c4tren@gmail.com>
Message-id: 20200604090830.33885-1-ppandit@redhat.com
Suggested-by: BALATON Zoltan <balaton@eik.bme.hu>
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit a98610c429d52db0937c1e48659428929835c455)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'qapi/qobject-output-visitor.c')
0 files changed, 0 insertions, 0 deletions