From: Peter Maydell <[email protected]> The sm501 code doesn't check whether a right-to-left operation has specified a width greater than the x-coordinate (which would make it extend off the left edge of the screen), or similarly a height greater than the y-coordinate. This means the guest can misprogram the device so that we underflow when calculating the address of the top left pixel, which might result in accessing out of bounds memory. Catch this as a guest error and ignore the operation.
Reported-by: Yannick Wang Tested-by: BALATON Zoltan <[email protected]> Reviewed-by: BALATON Zoltan <[email protected]> Signed-off-by: Peter Maydell <[email protected]> Message-id: [email protected] Cc: [email protected] Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3920 Signed-off-by: Peter Maydell <[email protected]> (cherry picked from commit b378a1bd86b4f25255eada916e34ebd66a3e7437) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/display/sm501.c b/hw/display/sm501.c index 09edcf86f8e..13ccc4941df 100644 --- a/hw/display/sm501.c +++ b/hw/display/sm501.c @@ -722,6 +722,10 @@ static void sm501_2d_operation(SM501State *s) } if (rtl) { + if (dst_x < (width - 1) || dst_y < (height - 1)) { + qemu_log_mask(LOG_GUEST_ERROR, "sm501: RTL op out of bounds\n"); + return; + } dst_x -= width - 1; dst_y -= height - 1; } @@ -747,6 +751,10 @@ static void sm501_2d_operation(SM501State *s) } if (rtl) { + if (src_x < (width - 1) || src_y < (height - 1)) { + qemu_log_mask(LOG_GUEST_ERROR, "sm501: RTL op out of bounds\n"); + return; + } src_x -= width - 1; src_y -= height - 1; } -- 2.47.3
