mirror of
https://github.com/xemu-project/xemu.git
synced 2024-12-03 17:11:01 +00:00
00f4269743
The QXL_IO_LOG command allows the guest to send log messages to the host via a buffer in the QXLRam struct. QEMU prints these to the console if the qxl 'guestdebug' option is set to non-zero. It will also feed them to the trace subsystem if any backends are built-in. In both cases the log_buf data will get treated as being as a nul terminated string, by the printf '%s' format specifier and / or other code reading the buffer. QEMU does nothing to guarantee that the log_buf really is nul terminated, so there is potential for out of bounds array access. This would affect any QEMU which has the log, syslog or ftrace trace backends built into QEMU. It can only be triggered if the 'qxl_io_log' trace event is enabled, however, so they are not vulnerable without specific administrative action to enable this. It would also affect QEMU if the 'guestdebug' parameter is set to a non-zero value, which again is not the default and requires explicit admin opt-in. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20190123120016.4538-2-berrange@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
||
|---|---|---|
| .. | ||
| ads7846.c | ||
| bcm2835_fb.c | ||
| blizzard.c | ||
| bochs-display.c | ||
| cg3.c | ||
| cirrus_vga_internal.h | ||
| cirrus_vga_isa.c | ||
| cirrus_vga_rop2.h | ||
| cirrus_vga_rop.h | ||
| cirrus_vga.c | ||
| dpcd.c | ||
| edid-generate.c | ||
| edid-region.c | ||
| exynos4210_fimd.c | ||
| framebuffer.c | ||
| framebuffer.h | ||
| g364fb.c | ||
| jazz_led.c | ||
| Makefile.objs | ||
| milkymist-tmu2.c | ||
| milkymist-vgafb_template.h | ||
| milkymist-vgafb.c | ||
| omap_dss.c | ||
| omap_lcd_template.h | ||
| omap_lcdc.c | ||
| pl110_template.h | ||
| pl110.c | ||
| pxa2xx_lcd.c | ||
| pxa2xx_template.h | ||
| qxl-logger.c | ||
| qxl-render.c | ||
| qxl.c | ||
| qxl.h | ||
| ramfb-standalone.c | ||
| ramfb.c | ||
| sii9022.c | ||
| sm501_template.h | ||
| sm501.c | ||
| ssd0303.c | ||
| ssd0323.c | ||
| tc6393xb_template.h | ||
| tc6393xb.c | ||
| tcx.c | ||
| trace-events | ||
| vga_int.h | ||
| vga_regs.h | ||
| vga-helpers.h | ||
| vga-isa-mm.c | ||
| vga-isa.c | ||
| vga-pci.c | ||
| vga.c | ||
| virtio-gpu-3d.c | ||
| virtio-gpu-pci.c | ||
| virtio-gpu.c | ||
| virtio-vga.c | ||
| vmware_vga.c | ||
| xenfb.c | ||
| xlnx_dp.c | ||