mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3693f217d3
qemu/hw/display
History
Daniel P. Berrangé 00f4269743 display: ensure qxl log_buf is a nul terminated string 
The QXL_IO_LOG command allows the guest to send log messages to the host
via a buffer in the QXLRam struct. QEMU prints these to the console if
the qxl 'guestdebug' option is set to non-zero. It will also feed them
to the trace subsystem if any backends are built-in.

In both cases the log_buf data will get treated as being as a nul
terminated string, by the printf '%s' format specifier and / or other
code reading the buffer.

QEMU does nothing to guarantee that the log_buf really is nul terminated,
so there is potential for out of bounds array access.

This would affect any QEMU which has the log, syslog or ftrace trace
backends built into QEMU. It can only be triggered if the 'qxl_io_log'
trace event is enabled, however, so they are not vulnerable without
specific administrative action to enable this.

It would also affect QEMU if the 'guestdebug' parameter is set to a
non-zero value, which again is not the default and requires explicit
admin opt-in.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20190123120016.4538-2-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2019-01-24 14:16:56 +00:00
..
ads7846.c ssi: change ssi_slave_init to be a realize ops 2016-07-04 13:15:22 +01:00
bcm2835_fb.c hw/display/bcm2835_fb: Silence Coverity warning about multiply overflow 2018-10-08 14:55:05 +01:00
blizzard.c Replace all occurances of __FUNCTION__ with __func__ 2018-01-22 09:46:18 +01:00
bochs-display.c bochs-display: wire up edid support 2018-10-15 09:57:33 +02:00
cg3.c cpus hw target: Use warn_report() & friends to report warnings 2018-10-19 14:51:34 +02:00
cirrus_vga_internal.h hw/display/cirrus_vga: Move "isa-cirrus-vga" device into a separate file 2018-10-15 09:57:33 +02:00
cirrus_vga_isa.c hw/display/cirrus_vga: Move "isa-cirrus-vga" device into a separate file 2018-10-15 09:57:33 +02:00
cirrus_vga_rop2.h cirrus: fix PUTPIXEL macro 2017-03-27 12:14:45 +02:00
cirrus_vga_rop.h cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16 2017-03-17 10:23:44 +01:00
cirrus_vga.c cirrus_vga/migration: update the bank offset before use 2018-11-27 07:47:57 +01:00
dpcd.c maint: Fix macros with broken 'do/while(0); ' usage 2018-01-16 14:54:52 +01:00
edid-generate.c edid: silence a stringop-overflow warning 2018-11-12 14:14:18 +01:00
edid-region.c display/edid: add region helper. 2018-09-27 08:07:51 +02:00
exynos4210_fimd.c use dpy_gfx_update_full 2018-08-30 13:24:13 +02:00
framebuffer.c memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshot 2018-02-13 16:15:09 +01:00
framebuffer.h framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer 2015-07-24 13:57:45 +02:00
g364fb.c display/g364fb: Convert sysbus init function to realize function 2018-12-13 13:47:57 +00:00
jazz_led.c use dpy_gfx_update_full 2018-08-30 13:24:13 +02:00
Makefile.objs hw/display/cirrus_vga: Move "isa-cirrus-vga" device into a separate file 2018-10-15 09:57:33 +02:00
milkymist-tmu2.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
milkymist-vgafb_template.h milkymist-vgafb: swap pixel data in source buffer 2014-02-04 19:34:30 +01:00
milkymist-vgafb.c milkymist: update specification URLs 2016-06-20 18:12:04 +02:00
omap_dss.c Replace all occurances of __FUNCTION__ with __func__ 2018-01-22 09:46:18 +01:00
omap_lcd_template.h omap_lcdc: Remove support for DEPTH != 32 2016-05-12 13:22:24 +01:00
omap_lcdc.c omap_lcdc: Remove support for DEPTH != 32 2016-05-12 13:22:24 +01:00
pl110_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
pl110.c pl110: Implement vertical compare/next base interrupts 2018-01-25 11:45:30 +00:00
pxa2xx_lcd.c Replace all occurances of __FUNCTION__ with __func__ 2018-01-22 09:46:18 +01:00
pxa2xx_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
qxl-logger.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
qxl-render.c qxl: support mono cursors with inverted colors 2018-09-27 08:10:07 +02:00
qxl.c display: ensure qxl log_buf is a nul terminated string 2019-01-24 14:16:56 +00:00
qxl.h qxl: store channel id in qxl->id 2018-10-29 10:43:19 +01:00
ramfb-standalone.c trivial: Don't include isa.h if it is not really necessary 2019-01-09 11:24:35 +01:00
ramfb.c ramfb: enable vgabios 2018-07-02 17:21:52 +02:00
sii9022.c hw/sii9022: Add support for Silicon Image SII9022 2018-03-01 11:13:36 +00:00
sm501_template.h sm501: Misc clean ups 2017-04-24 12:32:12 +01:00
sm501.c sm501: Adjust endianness of pixel value in rectangle fill 2018-09-25 11:12:25 +10:00
ssd0303.c hw/i2c: Use DeviceClass::realize instead of I2CSlaveClass::init 2018-06-01 15:14:31 +02:00
ssd0323.c vmstateify ssd0323 display 2016-09-22 18:13:08 +01:00
tc6393xb_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
tc6393xb.c avoid TABs in files that only contain a few 2019-01-11 15:46:56 +01:00
tcx.c cpus hw target: Use warn_report() & friends to report warnings 2018-10-19 14:51:34 +02:00
trace-events display: ensure qxl log_buf is a nul terminated string 2019-01-24 14:16:56 +00:00
vga_int.h vga_int: remove unused function protype 2018-10-29 10:43:48 +01:00
vga_regs.h hw/display/vga: "vga.h" only contains registers defs, rename it "vga_regs.h" 2017-12-18 17:07:02 +03:00
vga-helpers.h vga: stop passing pointers to vga_draw_line* functions 2017-09-01 13:52:43 +02:00
vga-isa-mm.c hw/display/vga-isa-mm: Convert away from old_mmio 2018-08-21 09:52:22 +02:00
vga-isa.c vga: disable global_vmstate for 3.0+ machine types 2018-07-03 11:19:49 +02:00
vga-pci.c secondary-vga: delete mmio subregions upon exit 2018-10-05 11:23:37 +02:00
vga.c avoid TABs in files that only contain a few 2019-01-11 15:46:56 +01:00
virtio-gpu-3d.c avoid TABs in files that only contain a few 2019-01-11 15:46:56 +01:00
virtio-gpu-pci.c virtio: split virtio gpu bits from virtio-pci.h 2019-01-17 21:10:57 -05:00
virtio-gpu.c vmstate: constify VMStateField 2018-11-27 15:35:15 +01:00
virtio-vga.c virtio: split virtio gpu bits from virtio-pci.h 2019-01-17 21:10:57 -05:00
vmware_vga.c use dpy_gfx_update_full 2018-08-30 13:24:13 +02:00
xenfb.c xen: re-name XenDevice to XenLegacyDevice... 2019-01-14 13:45:40 +00:00
xlnx_dp.c use dpy_gfx_update_full 2018-08-30 13:24:13 +02:00