Prasad J Pandit 167d97a3de vmsvga: correct bitmap and pixmap size checks ...

When processing svga command DEFINE_CURSOR in vmsvga_fifo_run,
the computed BITMAP and PIXMAP size are checked against the
'cursor.mask[]' and 'cursor.image[]' array sizes in bytes.
Correct these checks to avoid OOB memory access.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1473338754-15430-1-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2016-09-13 09:24:35 +02:00

..

ads7846.c

ssi: change ssi_slave_init to be a realize ops

2016-07-04 13:15:22 +01:00

bcm2835_fb.c

hw: explicitly include qemu/log.h

2016-05-19 16:42:29 +02:00

blizzard.c

hw/display/blizzard: Remove blizzard_template.h

2016-05-12 13:22:30 +01:00

cg3.c

hw: explicitly include qemu/log.h

2016-05-19 16:42:29 +02:00

cirrus_vga_rop2.h

hw: move private headers to hw/ subdirectories.

2013-04-08 18:13:16 +02:00

cirrus_vga_rop.h

cirrus: Fix host CPU blits

2014-07-11 10:17:02 +02:00

cirrus_vga.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

dpcd.c

aux: Rename aux.[ch] to auxbus.[ch] for the benefit of Windows

2016-07-07 13:47:01 +01:00

exynos4210_fimd.c

hw/display: QOM'ify exynos4210_fimd.c

2016-05-12 13:22:27 +01:00

framebuffer.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

framebuffer.h

framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer

2015-07-24 13:57:45 +02:00

g364fb.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

jazz_led.c

hw/display: QOM'ify jazz_led.c

2016-05-13 09:33:38 +01:00

Makefile.objs

introduce xlnx-dp

2016-06-14 16:01:03 +01:00

milkymist-tmu2.c

milkymist: fix tmu2.c build failure (missing error.h include)

2016-06-21 13:25:09 +01:00

milkymist-vgafb_template.h

milkymist-vgafb: swap pixel data in source buffer

2014-02-04 19:34:30 +01:00

milkymist-vgafb.c

milkymist: update specification URLs

2016-06-20 18:12:04 +02:00

omap_dss.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

omap_lcd_template.h

omap_lcdc: Remove support for DEPTH != 32

2016-05-12 13:22:24 +01:00

omap_lcdc.c

omap_lcdc: Remove support for DEPTH != 32

2016-05-12 13:22:24 +01:00

pl110_template.h

display: avoid multi-statement macro

2014-01-31 14:47:33 +00:00

pl110.c

hw: explicitly include qemu/log.h

2016-05-19 16:42:29 +02:00

pxa2xx_lcd.c

arm: Clean up includes

2016-01-29 15:07:23 +00:00

pxa2xx_template.h

display: avoid multi-statement macro

2014-01-31 14:47:33 +00:00

qxl-logger.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

qxl-render.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

qxl.c

qxl: fix qxl_set_dirty call in qxl_dirty_one_surface

2016-07-20 12:08:14 +02:00

qxl.h

Clean up decorations and whitespace around header guards

2016-07-12 16:20:46 +02:00

sm501_template.h

hw: use ld_p/st_p instead of ld_raw/st_raw

2014-06-05 16:04:17 +02:00

sm501.c

hw: explicitly include qemu-common.h and cpu.h

2016-03-22 22:20:17 +01:00

ssd0303.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

ssd0323.c

ssi: change ssi_slave_init to be a realize ops

2016-07-04 13:15:22 +01:00

tc6393xb_template.h

display: avoid multi-statement macro

2014-01-31 14:47:33 +00:00

tc6393xb.c

qemu-common: stop including qemu/host-utils.h from qemu-common.h

2016-05-19 16:42:28 +02:00

tcx.c

hw: explicitly include qemu-common.h and cpu.h

2016-03-22 22:20:17 +01:00

trace-events

trace-events: fix first line comment in trace-events

2016-08-12 10:36:01 +01:00

vga_int.h

Clean up decorations and whitespace around header guards

2016-07-12 16:20:46 +02:00

vga-helpers.h

vga: Rename vga_template.h to vga-helpers.h

2014-09-30 13:34:09 +02:00

vga-isa-mm.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

vga-isa.c

portio: keep references on portio

2016-09-08 18:05:21 +04:00

vga-pci.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

vga.c

coccinelle: Remove unnecessary variables for function return value

2016-06-20 16:38:13 +02:00

vga.h

Clean up ill-advised or unusual header guards

2016-07-12 16:20:46 +02:00

virtio-gpu-3d.c

Use #include "..." for our own headers, <...> for others

2016-07-12 16:19:16 +02:00

virtio-gpu-pci.c

hw/virtio-pci: fix virtio behaviour

2016-07-29 00:07:10 +03:00

virtio-gpu.c

virtio-gpu: Wrap in vmstate

2016-07-21 20:44:20 +03:00

virtio-vga.c

hw/virtio-pci: fix virtio behaviour

2016-07-29 00:07:10 +03:00

vmware_vga.c

vmsvga: correct bitmap and pixmap size checks

2016-09-13 09:24:35 +02:00

xenfb.c

os-posix: include sys/mman.h

2016-06-16 18:39:03 +02:00

xlnx_dp.c

xlnx_dp: fix iffy xlnx_dp_aux_push_tx_fifo

2016-07-07 13:47:00 +01:00