mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-12-14 03:10:47 +00:00
Code Issues Releases Activity

xen: fix build failure after XSA-208

Browse Source 
Approved by:	bapt
MFH:		2017Q1
Sponsored by:	Citrix Systems R&D
This commit is contained in:
Roger Pau Monné 2017-02-14 10:22:49 +00:00
parent 35564ce926
commit c409805a2f
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=434070
2 changed files with 25 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sysutils/xen-tools/Makefile
View File

@ -3,7 +3,7 @@
PORTNAME= xen PORTNAME= xen
PKGNAMESUFFIX= -tools PKGNAMESUFFIX= -tools
PORTVERSION= 4.7.1 PORTVERSION= 4.7.1
PORTREVISION= 2 PORTREVISION= 3
CATEGORIES= sysutils emulators CATEGORIES= sysutils emulators
MASTER_SITES= http://downloads.xenproject.org/release/xen/${PORTVERSION}/ MASTER_SITES= http://downloads.xenproject.org/release/xen/${PORTVERSION}/

40
sysutils/xen-tools/files/xsa208-qemuu.patch
View File

@ -1,40 +1,47 @@
From: Li Qiang <address@hidden> From 7eaaf4ba68fab40f1945d761438bdaa44fbf37d7 Mon Sep 17 00:00:00 2001
From: Li Qiang <liqiang6-s@360.cn>
Date: Thu, 9 Feb 2017 14:36:41 -0800
Subject: [PATCH] cirrus: fix oob access issue (CVE-2017-2615)
When doing bitblt copy in backward mode, we should minus the When doing bitblt copy in backward mode, we should minus the
blt width first just like the adding in the forward mode. This blt width first just like the adding in the forward mode. This
can avoid the oob access of the front of vga's vram. can avoid the oob access of the front of vga's vram.
Signed-off-by: Li Qiang <address@hidden> This is XSA-208.
Message-id: address@hidden
upstream-commit-id: 62d4c6bd5263bb8413a06c80144fc678df6dfb64
Signed-off-by: Li Qiang <liqiang6-s@360.cn>
{ kraxel: with backward blits (negative pitch) addr is the topmost { kraxel: with backward blits (negative pitch) addr is the topmost
address, so check it as-is against vram size ] address, so check it as-is against vram size ]
[ This is CVE-2017-2615 / XSA-208 - Ian Jackson ] Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Cc: address@hidden Cc: Laszlo Ersek <lersek@redhat.com>
Cc: P J P <address@hidden> Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Laszlo Ersek <address@hidden> Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
Cc: Paolo Bonzini <address@hidden>
Cc: Wolfgang Bumiller <address@hidden>
Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106) Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
Signed-off-by: Gerd Hoffmann <address@hidden> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
--- ---
hw/display/cirrus_vga.c | 7 +++---- hw/display/cirrus_vga.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-) 1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index bdb092e..3bbe3d5 100644 index 5198037..7bf3707 100644
--- a/hw/display/cirrus_vga.c --- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c +++ b/hw/display/cirrus_vga.c
@@ -277,10 +277,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, @@ -272,10 +272,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s,
} {
if (pitch < 0) { if (pitch < 0) {
int64_t min = addr int64_t min = addr
- + ((int64_t)s->cirrus_blt_height-1) * pitch; - + ((int64_t)s->cirrus_blt_height-1) * pitch;
- int32_t max = addr - int32_t max = addr
- + s->cirrus_blt_width; - + s->cirrus_blt_width;
- if (min < 0 || max > s->vga.vram_size) { - if (min < 0 || max >= s->vga.vram_size) {
+ + ((int64_t)s->cirrus_blt_height - 1) * pitch + + ((int64_t)s->cirrus_blt_height - 1) * pitch
+ - s->cirrus_blt_width; + - s->cirrus_blt_width;
+ if (min < -1 || addr >= s->vga.vram_size) { + if (min < -1 || addr >= s->vga.vram_size) {
@ -42,4 +49,5 @@ index bdb092e..3bbe3d5 100644
} }
} else { } else {
-- --
1.8.3.1 2.10.1 (Apple Git-78)