Gerd Hoffmann 7cdc61becd vga: fix region calculation ...

Typically the scanline length and the line offset are identical.  But
in case they are not our calculation for region_end is incorrect.  Using
line_offset is fine for all scanlines, except the last one where we have
to use the actual scanline length.

Fixes: CVE-2018-7550
Reported-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Tested-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Message-id: 20180309143704.13420-1-kraxel@redhat.com

2018-03-12 11:45:21 +01:00

..

ads7846.c

ssi: change ssi_slave_init to be a realize ops

2016-07-04 13:15:22 +01:00

bcm2835_fb.c

hw: explicitly include qemu/log.h

2016-05-19 16:42:29 +02:00

blizzard.c

Replace all occurances of __FUNCTION__ with __func__

2018-01-22 09:46:18 +01:00

cg3.c

memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshot

2018-02-13 16:15:09 +01:00

cirrus_vga_rop2.h

cirrus: fix PUTPIXEL macro

2017-03-27 12:14:45 +02:00

cirrus_vga_rop.h

cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16

2017-03-17 10:23:44 +01:00

cirrus_vga.c

hw/display/vga: "vga_int.h" requires "ui/console.h"

2017-12-18 17:07:02 +03:00

dpcd.c

maint: Fix macros with broken 'do/while(0); ' usage

2018-01-16 14:54:52 +01:00

exynos4210_fimd.c

memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshot

2018-02-13 16:15:09 +01:00

framebuffer.c

memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshot

2018-02-13 16:15:09 +01:00

framebuffer.h

…

g364fb.c

g364fb: fix DirtyBitmapSnapshot leak

2018-03-06 14:00:58 +01:00

jazz_led.c

jazz_led: fix bad snprintf

2017-05-10 10:19:24 +03:00

Makefile.objs

hw/sii9022: Add support for Silicon Image SII9022

2018-03-01 11:13:36 +00:00

milkymist-tmu2.c

Include qapi/error.h exactly where needed

2018-02-09 13:50:17 +01:00

milkymist-vgafb_template.h

…

milkymist-vgafb.c

milkymist: update specification URLs

2016-06-20 18:12:04 +02:00

omap_dss.c

Replace all occurances of __FUNCTION__ with __func__

2018-01-22 09:46:18 +01:00

omap_lcd_template.h

omap_lcdc: Remove support for DEPTH != 32

2016-05-12 13:22:24 +01:00

omap_lcdc.c

omap_lcdc: Remove support for DEPTH != 32

2016-05-12 13:22:24 +01:00

pl110_template.h

…

pl110.c

pl110: Implement vertical compare/next base interrupts

2018-01-25 11:45:30 +00:00

pxa2xx_lcd.c

Replace all occurances of __FUNCTION__ with __func__

2018-01-22 09:46:18 +01:00

pxa2xx_template.h

…

qxl-logger.c

hw/display: Clean up includes

2016-01-29 15:07:24 +00:00

qxl-render.c

Replace all occurances of __FUNCTION__ with __func__

2018-01-22 09:46:18 +01:00

qxl.c

Include qapi/error.h exactly where needed

2018-02-09 13:50:17 +01:00

qxl.h

Replace all occurances of __FUNCTION__ with __func__

2018-01-22 09:46:18 +01:00

sii9022.c

hw/sii9022: Add support for Silicon Image SII9022

2018-03-01 11:13:36 +00:00

sm501_template.h

sm501: Misc clean ups

2017-04-24 12:32:12 +01:00

sm501.c

memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshot

2018-02-13 16:15:09 +01:00

ssd0303.c

i2c: Allow I2C devices to NAK start events

2017-01-09 11:40:20 +00:00

ssd0323.c

vmstateify ssd0323 display

2016-09-22 18:13:08 +01:00

tc6393xb_template.h

…

tc6393xb.c

Replace all occurances of __FUNCTION__ with __func__

2018-01-22 09:46:18 +01:00

tcx.c

memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshot

2018-02-13 16:15:09 +01:00

trace-events

hw/sii9022: Add support for Silicon Image SII9022

2018-03-01 11:13:36 +00:00

vga_int.h

hw/display/vga: "vga_int.h" requires "ui/console.h"

2017-12-18 17:07:02 +03:00

vga_regs.h

hw/display/vga: "vga.h" only contains registers defs, rename it "vga_regs.h"

2017-12-18 17:07:02 +03:00

vga-helpers.h

vga: stop passing pointers to vga_draw_line* functions

2017-09-01 13:52:43 +02:00

vga-isa-mm.c

hw/display/vga: extract public API from i386/pc to "hw/display/vga.h"

2017-12-18 17:07:02 +03:00

vga-isa.c

hw/display/vga: extract public API from i386/pc to "hw/display/vga.h"

2017-12-18 17:07:02 +03:00

vga-pci.c

hw/display/vga: "vga_int.h" requires "ui/console.h"

2017-12-18 17:07:02 +03:00

vga.c

vga: fix region calculation

2018-03-12 11:45:21 +01:00

virtio-gpu-3d.c

virtio-gpu-3d: add support for second capability set (v4)

2018-02-26 13:41:34 +01:00

virtio-gpu-pci.c

Include qapi/error.h exactly where needed

2018-02-09 13:50:17 +01:00

virtio-gpu.c

virtio-gpu-3d: add support for second capability set (v4)

2018-02-26 13:41:34 +01:00

virtio-vga.c

hw/display/vga: "vga_int.h" requires "ui/console.h"

2017-12-18 17:07:02 +03:00

vmware_vga.c

hw/display/vga: "vga_int.h" requires "ui/console.h"

2017-12-18 17:07:02 +03:00

xenfb.c

Replace all occurances of __FUNCTION__ with __func__

2018-01-22 09:46:18 +01:00

xlnx_dp.c

Include qapi/error.h exactly where needed

2018-02-09 13:50:17 +01:00