The sm501 code doesn't check whether a right-to-left operation has specified a width greater than the x-coordinate (which would make it extend off the left edge of the screen), or similarly a height greater than the y-coordinate. This means the guest can misprogram the device so that we underflow when calculating the address of the top left pixel, which might result in accessing out of bounds memory. Catch this as a guest error and ignore the operation.
Reported-by: Yannick Wang Tested-by: BALATON Zoltan <[email protected]> Reviewed-by: BALATON Zoltan <[email protected]> Signed-off-by: Peter Maydell <[email protected]> Message-id: [email protected] Cc: [email protected] Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3920 Signed-off-by: Peter Maydell <[email protected]> --- hw/display/sm501.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/display/sm501.c b/hw/display/sm501.c index af870048372..0da25477bcc 100644 --- a/hw/display/sm501.c +++ b/hw/display/sm501.c @@ -723,6 +723,10 @@ static void sm501_2d_operation(SM501State *s) } if (rtl) { + if (dst_x < (width - 1) || dst_y < (height - 1)) { + qemu_log_mask(LOG_GUEST_ERROR, "sm501: RTL op out of bounds\n"); + return; + } dst_x -= width - 1; dst_y -= height - 1; } @@ -748,6 +752,10 @@ static void sm501_2d_operation(SM501State *s) } if (rtl) { + if (src_x < (width - 1) || src_y < (height - 1)) { + qemu_log_mask(LOG_GUEST_ERROR, "sm501: RTL op out of bounds\n"); + return; + } src_x -= width - 1; src_y -= height - 1; } -- 2.43.0
