diff options
| author | Mauro Matteo Cascella <mcascell@redhat.com> | 2022-04-07 10:17:12 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2022-04-07 12:30:54 +0200 |
| commit | fa892e9abb728e76afcf27323ab29c57fb0fe7aa (patch) | |
| tree | 2e3db9e407e4559f313700a8912e431cf96a5880 /hw/display/vmware_vga.c | |
| parent | 9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895 (diff) | |
ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)
Prevent potential integer overflow by limiting 'width' and 'height' to
512x512. Also change 'datasize' type to size_t. Refer to security
advisory https://starlabs.sg/advisories/22-4206/ for more information.
Fixes: CVE-2021-4206
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/display/vmware_vga.c')
| -rw-r--r-- | hw/display/vmware_vga.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c index 98c83474ad..45d06cbe25 100644 --- a/hw/display/vmware_vga.c +++ b/hw/display/vmware_vga.c @@ -515,6 +515,8 @@ static inline void vmsvga_cursor_define(struct vmsvga_state_s *s, int i, pixels; qc = cursor_alloc(c->width, c->height); + assert(qc != NULL); + qc->hot_x = c->hot_x; qc->hot_y = c->hot_y; switch (c->bpp) { |