vga: handle cirrus vbe mode wraparounds.
authorGerd Hoffmann <kraxel@redhat.com>
Tue, 10 Oct 2017 14:13:22 +0000 (16:13 +0200)
committerGerd Hoffmann <kraxel@redhat.com>
Tue, 17 Oct 2017 07:59:00 +0000 (09:59 +0200)
commit28f77de26a4f9995458ddeb9d34bb06c0193bdc9
tree50b07d4486fde1f9415c24810cbcd46e910da334
parent362f811793ff6cb4d209ab61d76cc4f841bb5e46
vga: handle cirrus vbe mode wraparounds.

Commit "3d90c62548 vga: stop passing pointers to vga_draw_line*
functions" is incomplete.  It doesn't handle the case that the vga
rendering code tries to create a shared surface, i.e. a pixman image
backed by vga video memory.  That can not work in case the guest display
wraps from end of video memory to the start.  So force shadowing in that
case.  Also adjust the snapshot region calculation.

Can trigger with cirrus only, when programming vbe modes using the bochs
api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds
can't happen.

Fixes: CVE-2017-13672
Fixes: 3d90c6254863693a6b13d918d2b8682e08bbc681
Cc: P J P <ppandit@redhat.com>
Reported-by: David Buchanan <d@vidbuchanan.co.uk>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010141323.14049-3-kraxel@redhat.com
hw/display/vga.c