Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue (CVE-2017-TODO)

2017-01-25 Thread Laszlo Ersek
On 01/25/17 11:50, Wolfgang Bumiller wrote: > On Wed, Jan 25, 2017 at 11:35:44AM +0100, Laszlo Ersek wrote: >> On 01/25/17 10:50, Gerd Hoffmann wrote: >>> On Mi, 2017-01-25 at 09:30 +0100, Wolfgang Bumiller wrote: On Wed, Jan 25, 2017 at 08:07:05AM +0100, Gerd Hoffmann wrote: > From: Li Qi

Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue (CVE-2017-TODO)

2017-01-25 Thread Wolfgang Bumiller
On Wed, Jan 25, 2017 at 11:35:44AM +0100, Laszlo Ersek wrote: > On 01/25/17 10:50, Gerd Hoffmann wrote: > > On Mi, 2017-01-25 at 09:30 +0100, Wolfgang Bumiller wrote: > >> On Wed, Jan 25, 2017 at 08:07:05AM +0100, Gerd Hoffmann wrote: > >>> From: Li Qiang > >>> > >>> When doing bitblt copy in back

Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue (CVE-2017-TODO)

2017-01-25 Thread Gerd Hoffmann
On Mi, 2017-01-25 at 08:07 +0100, Gerd Hoffmann wrote: > From: Li Qiang > > When doing bitblt copy in backward mode, we should minus the > blt width first just like the adding in the forward mode. This > can avoid the oob access of the front of vga's vram. > > Signed-off-by: Li Qiang > Message-

Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue (CVE-2017-TODO)

2017-01-25 Thread Laszlo Ersek
On 01/25/17 10:50, Gerd Hoffmann wrote: > On Mi, 2017-01-25 at 09:30 +0100, Wolfgang Bumiller wrote: >> On Wed, Jan 25, 2017 at 08:07:05AM +0100, Gerd Hoffmann wrote: >>> From: Li Qiang >>> >>> When doing bitblt copy in backward mode, we should minus the >>> blt width first just like the adding in

Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue (CVE-2017-TODO)

2017-01-25 Thread Gerd Hoffmann
On Mi, 2017-01-25 at 09:30 +0100, Wolfgang Bumiller wrote: > On Wed, Jan 25, 2017 at 08:07:05AM +0100, Gerd Hoffmann wrote: > > From: Li Qiang > > > > When doing bitblt copy in backward mode, we should minus the > > blt width first just like the adding in the forward mode. This > > can avoid the

Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue (CVE-2017-TODO)

2017-01-25 Thread Wolfgang Bumiller
On Wed, Jan 25, 2017 at 08:07:05AM +0100, Gerd Hoffmann wrote: > From: Li Qiang > > When doing bitblt copy in backward mode, we should minus the > blt width first just like the adding in the forward mode. This > can avoid the oob access of the front of vga's vram. > > Signed-off-by: Li Qiang >

[Qemu-devel] [PATCH] cirrus: fix oob access issue (CVE-2017-TODO)

2017-01-24 Thread Gerd Hoffmann
From: Li Qiang When doing bitblt copy in backward mode, we should minus the blt width first just like the adding in the forward mode. This can avoid the oob access of the front of vga's vram. Signed-off-by: Li Qiang Message-id: 5887254f.863a240a.2c122.5...@mx.google.com { kraxel: with backward