Gerd Hoffmann c1b886c45d vbe: rework sanity checks ... Plug a bunch of holes in the bochs dispi interface parameter checking. Add a function doing verification on all registers. Call that unconditionally on every register write. That way we should catch everything, even changing one register affecting the valid range of another register. Some of the holes have been added by commit e9c6149f6a. Before that commit the maximum possible framebuffer (VBE_DISPI_MAX_XRES * VBE_DISPI_MAX_YRES * 32 bpp) has been smaller than the qemu vga memory (8MB) and the checking for VBE_DISPI_MAX_XRES + VBE_DISPI_MAX_YRES + VBE_DISPI_MAX_BPP was ok. Some of the holes have been there forever, such as VBE_DISPI_INDEX_X_OFFSET and VBE_DISPI_INDEX_Y_OFFSET register writes lacking any verification. Security impact: (1) Guest can make the ui (gtk/vnc/...) use memory rages outside the vga frame buffer as source -> host memory leak. Memory isn't leaked to the guest but to the vnc client though. (2) Qemu will segfault in case the memory range happens to include unmapped areas -> Guest can DoS itself. The guest can not modify host memory, so I don't think this can be used by the guest to escape. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>		2014-09-04 08:23:14 +02:00
..
ads7846.c
blizzard.c
blizzard_template.h
cg3.c
cirrus_vga.c
cirrus_vga_rop.h
cirrus_vga_rop2.h
cirrus_vga_template.h
exynos4210_fimd.c
framebuffer.c
framebuffer.h
g364fb.c
jazz_led.c
Makefile.objs
milkymist-tmu2.c
milkymist-vgafb.c
milkymist-vgafb_template.h
omap_dss.c
omap_lcd_template.h
omap_lcdc.c
pl110.c
pl110_template.h
pxa2xx_lcd.c
pxa2xx_template.h
qxl-logger.c
qxl-render.c	qxl-render: add more sanity checks	2014-09-01 10:19:03 +02:00
qxl.c	vbe: make bochs dispi interface return the correct memory size with qxl	2014-09-04 08:22:48 +02:00
qxl.h
sm501.c
sm501_template.h
ssd0303.c
ssd0323.c
tc6393xb.c
tc6393xb_template.h
tcx.c
vga-isa-mm.c
vga-isa.c
vga-pci.c
vga.c	vbe: rework sanity checks	2014-09-04 08:23:14 +02:00
vga.h
vga_int.h	vbe: make bochs dispi interface return the correct memory size with qxl	2014-09-04 08:22:48 +02:00
vga_template.h
vmware_vga.c
xenfb.c