Although not actually exploitable at the moment, a negative width/height could make datasize wrap around and potentially lead to buffer overflow. Since there is no reason a negative width/height is ever appropriate, modify QEMUCursor struct and cursor_alloc prototype to accept uint16_t. This protects us against accidentally introducing future bugs. Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reported-by: Jacek Halon <jacek.halon@gmail.com> Reported-by: Yair Mizrahi <yairh33@gmail.com> Reported-by: Elsayed El-Refa'ei <e.elrefaei99@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20230523163023.608121-1-mcascell@redhat.com>
		
			
				
	
	
		
			252 lines
		
	
	
		
			6.9 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			252 lines
		
	
	
		
			6.9 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
#include "qemu/osdep.h"
 | 
						|
#include "ui/console.h"
 | 
						|
 | 
						|
#include "cursor_hidden.xpm"
 | 
						|
#include "cursor_left_ptr.xpm"
 | 
						|
 | 
						|
/* for creating built-in cursors */
 | 
						|
static QEMUCursor *cursor_parse_xpm(const char *xpm[])
 | 
						|
{
 | 
						|
    QEMUCursor *c;
 | 
						|
    uint32_t ctab[128];
 | 
						|
    unsigned int width, height, colors, chars;
 | 
						|
    unsigned int line = 0, i, r, g, b, x, y, pixel;
 | 
						|
    char name[16];
 | 
						|
    uint8_t idx;
 | 
						|
 | 
						|
    /* parse header line: width, height, #colors, #chars */
 | 
						|
    if (sscanf(xpm[line], "%u %u %u %u",
 | 
						|
               &width, &height, &colors, &chars) != 4) {
 | 
						|
        fprintf(stderr, "%s: header parse error: \"%s\"\n",
 | 
						|
                __func__, xpm[line]);
 | 
						|
        return NULL;
 | 
						|
    }
 | 
						|
    if (chars != 1) {
 | 
						|
        fprintf(stderr, "%s: chars != 1 not supported\n", __func__);
 | 
						|
        return NULL;
 | 
						|
    }
 | 
						|
    line++;
 | 
						|
 | 
						|
    /* parse color table */
 | 
						|
    for (i = 0; i < colors; i++, line++) {
 | 
						|
        if (sscanf(xpm[line], "%c c %15s", &idx, name) == 2) {
 | 
						|
            if (sscanf(name, "#%02x%02x%02x", &r, &g, &b) == 3) {
 | 
						|
                ctab[idx] = (0xff << 24) | (b << 16) | (g << 8) | r;
 | 
						|
                continue;
 | 
						|
            }
 | 
						|
            if (strcmp(name, "None") == 0) {
 | 
						|
                ctab[idx] = 0x00000000;
 | 
						|
                continue;
 | 
						|
            }
 | 
						|
        }
 | 
						|
        fprintf(stderr, "%s: color parse error: \"%s\"\n",
 | 
						|
                __func__, xpm[line]);
 | 
						|
        return NULL;
 | 
						|
    }
 | 
						|
 | 
						|
    /* parse pixel data */
 | 
						|
    c = cursor_alloc(width, height);
 | 
						|
    assert(c != NULL);
 | 
						|
 | 
						|
    for (pixel = 0, y = 0; y < height; y++, line++) {
 | 
						|
        for (x = 0; x < height; x++, pixel++) {
 | 
						|
            idx = xpm[line][x];
 | 
						|
            c->data[pixel] = ctab[idx];
 | 
						|
        }
 | 
						|
    }
 | 
						|
    return c;
 | 
						|
}
 | 
						|
 | 
						|
/* nice for debugging */
 | 
						|
void cursor_print_ascii_art(QEMUCursor *c, const char *prefix)
 | 
						|
{
 | 
						|
    uint32_t *data = c->data;
 | 
						|
    int x,y;
 | 
						|
 | 
						|
    for (y = 0; y < c->height; y++) {
 | 
						|
        fprintf(stderr, "%s: %2d: |", prefix, y);
 | 
						|
        for (x = 0; x < c->width; x++, data++) {
 | 
						|
            if ((*data & 0xff000000) != 0xff000000) {
 | 
						|
                fprintf(stderr, " "); /* transparent */
 | 
						|
            } else if ((*data & 0x00ffffff) == 0x00ffffff) {
 | 
						|
                fprintf(stderr, "."); /* white */
 | 
						|
            } else if ((*data & 0x00ffffff) == 0x00000000) {
 | 
						|
                fprintf(stderr, "X"); /* black */
 | 
						|
            } else {
 | 
						|
                fprintf(stderr, "o"); /* other */
 | 
						|
            }
 | 
						|
        }
 | 
						|
        fprintf(stderr, "|\n");
 | 
						|
    }
 | 
						|
}
 | 
						|
 | 
						|
QEMUCursor *cursor_builtin_hidden(void)
 | 
						|
{
 | 
						|
    return cursor_parse_xpm(cursor_hidden_xpm);
 | 
						|
}
 | 
						|
 | 
						|
QEMUCursor *cursor_builtin_left_ptr(void)
 | 
						|
{
 | 
						|
    return cursor_parse_xpm(cursor_left_ptr_xpm);
 | 
						|
}
 | 
						|
 | 
						|
QEMUCursor *cursor_alloc(uint16_t width, uint16_t height)
 | 
						|
{
 | 
						|
    QEMUCursor *c;
 | 
						|
    size_t datasize = width * height * sizeof(uint32_t);
 | 
						|
 | 
						|
    /* Modern physical hardware typically uses 512x512 sprites */
 | 
						|
    if (width > 512 || height > 512) {
 | 
						|
        return NULL;
 | 
						|
    }
 | 
						|
 | 
						|
    c = g_malloc0(sizeof(QEMUCursor) + datasize);
 | 
						|
    c->width  = width;
 | 
						|
    c->height = height;
 | 
						|
    c->refcount = 1;
 | 
						|
    return c;
 | 
						|
}
 | 
						|
 | 
						|
QEMUCursor *cursor_ref(QEMUCursor *c)
 | 
						|
{
 | 
						|
    c->refcount++;
 | 
						|
    return c;
 | 
						|
}
 | 
						|
 | 
						|
void cursor_unref(QEMUCursor *c)
 | 
						|
{
 | 
						|
    if (c == NULL)
 | 
						|
        return;
 | 
						|
    c->refcount--;
 | 
						|
    if (c->refcount)
 | 
						|
        return;
 | 
						|
    g_free(c);
 | 
						|
}
 | 
						|
 | 
						|
int cursor_get_mono_bpl(QEMUCursor *c)
 | 
						|
{
 | 
						|
    return DIV_ROUND_UP(c->width, 8);
 | 
						|
}
 | 
						|
 | 
						|
void cursor_set_mono(QEMUCursor *c,
 | 
						|
                     uint32_t foreground, uint32_t background, uint8_t *image,
 | 
						|
                     int transparent, uint8_t *mask)
 | 
						|
{
 | 
						|
    uint32_t *data = c->data;
 | 
						|
    uint8_t bit;
 | 
						|
    int x,y,bpl;
 | 
						|
    bool expand_bitmap_only = image == mask;
 | 
						|
    bool has_inverted_colors = false;
 | 
						|
    const uint32_t inverted = 0x80000000;
 | 
						|
 | 
						|
    /*
 | 
						|
     * Converts a monochrome bitmap with XOR mask 'image' and AND mask 'mask':
 | 
						|
     * https://docs.microsoft.com/en-us/windows-hardware/drivers/display/drawing-monochrome-pointers
 | 
						|
     */
 | 
						|
    bpl = cursor_get_mono_bpl(c);
 | 
						|
    for (y = 0; y < c->height; y++) {
 | 
						|
        bit = 0x80;
 | 
						|
        for (x = 0; x < c->width; x++, data++) {
 | 
						|
            if (transparent && mask[x/8] & bit) {
 | 
						|
                if (!expand_bitmap_only && image[x / 8] & bit) {
 | 
						|
                    *data = inverted;
 | 
						|
                    has_inverted_colors = true;
 | 
						|
                } else {
 | 
						|
                    *data = 0x00000000;
 | 
						|
                }
 | 
						|
            } else if (!transparent && !(mask[x/8] & bit)) {
 | 
						|
                *data = 0x00000000;
 | 
						|
            } else if (image[x/8] & bit) {
 | 
						|
                *data = 0xff000000 | foreground;
 | 
						|
            } else {
 | 
						|
                *data = 0xff000000 | background;
 | 
						|
            }
 | 
						|
            bit >>= 1;
 | 
						|
            if (bit == 0) {
 | 
						|
                bit = 0x80;
 | 
						|
            }
 | 
						|
        }
 | 
						|
        mask  += bpl;
 | 
						|
        image += bpl;
 | 
						|
    }
 | 
						|
 | 
						|
    /*
 | 
						|
     * If there are any pixels with inverted colors, create an outline (fill
 | 
						|
     * transparent neighbors with the background color) and use the foreground
 | 
						|
     * color as "inverted" color.
 | 
						|
     */
 | 
						|
    if (has_inverted_colors) {
 | 
						|
        data = c->data;
 | 
						|
        for (y = 0; y < c->height; y++) {
 | 
						|
            for (x = 0; x < c->width; x++, data++) {
 | 
						|
                if (*data == 0 /* transparent */ &&
 | 
						|
                        ((x > 0 && data[-1] == inverted) ||
 | 
						|
                         (x + 1 < c->width && data[1] == inverted) ||
 | 
						|
                         (y > 0 && data[-c->width] == inverted) ||
 | 
						|
                         (y + 1 < c->height && data[c->width] == inverted))) {
 | 
						|
                    *data = 0xff000000 | background;
 | 
						|
                }
 | 
						|
            }
 | 
						|
        }
 | 
						|
        data = c->data;
 | 
						|
        for (x = 0; x < c->width * c->height; x++, data++) {
 | 
						|
            if (*data == inverted) {
 | 
						|
                *data = 0xff000000 | foreground;
 | 
						|
            }
 | 
						|
        }
 | 
						|
    }
 | 
						|
}
 | 
						|
 | 
						|
void cursor_get_mono_image(QEMUCursor *c, int foreground, uint8_t *image)
 | 
						|
{
 | 
						|
    uint32_t *data = c->data;
 | 
						|
    uint8_t bit;
 | 
						|
    int x,y,bpl;
 | 
						|
 | 
						|
    bpl = cursor_get_mono_bpl(c);
 | 
						|
    memset(image, 0, bpl * c->height);
 | 
						|
    for (y = 0; y < c->height; y++) {
 | 
						|
        bit = 0x80;
 | 
						|
        for (x = 0; x < c->width; x++, data++) {
 | 
						|
            if (((*data & 0xff000000) == 0xff000000) &&
 | 
						|
                ((*data & 0x00ffffff) == foreground)) {
 | 
						|
                image[x/8] |= bit;
 | 
						|
            }
 | 
						|
            bit >>= 1;
 | 
						|
            if (bit == 0) {
 | 
						|
                bit = 0x80;
 | 
						|
            }
 | 
						|
        }
 | 
						|
        image += bpl;
 | 
						|
    }
 | 
						|
}
 | 
						|
 | 
						|
void cursor_get_mono_mask(QEMUCursor *c, int transparent, uint8_t *mask)
 | 
						|
{
 | 
						|
    uint32_t *data = c->data;
 | 
						|
    uint8_t bit;
 | 
						|
    int x,y,bpl;
 | 
						|
 | 
						|
    bpl = cursor_get_mono_bpl(c);
 | 
						|
    memset(mask, 0, bpl * c->height);
 | 
						|
    for (y = 0; y < c->height; y++) {
 | 
						|
        bit = 0x80;
 | 
						|
        for (x = 0; x < c->width; x++, data++) {
 | 
						|
            if ((*data & 0xff000000) != 0xff000000) {
 | 
						|
                if (transparent != 0) {
 | 
						|
                    mask[x/8] |= bit;
 | 
						|
                }
 | 
						|
            } else {
 | 
						|
                if (transparent == 0) {
 | 
						|
                    mask[x/8] |= bit;
 | 
						|
                }
 | 
						|
            }
 | 
						|
            bit >>= 1;
 | 
						|
            if (bit == 0) {
 | 
						|
                bit = 0x80;
 | 
						|
            }
 | 
						|
        }
 | 
						|
        mask += bpl;
 | 
						|
    }
 | 
						|
}
 |