File hw-display-qxl-Assert-memory-slot-fits-i.patch of Package qemu.30222
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 28 Nov 2022 21:27:41 +0100
Subject: hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Git-commit: 86fdb0582c653a9824183679403a85f588260d62
References: bsc#1205808, CVE-2022-4144
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221128202741.4945-6-philmd@linaro.org>
Signed-off-by: Dario Faggioli <dfaggioli@suse.com>
---
hw/display/qxl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index c51b0cd6c6f717a3f437ea0531c5..eaf10248742d17ad717ca6d51ea6 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1404,6 +1404,7 @@ static int qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta,
qxl_set_guest_bug(d, "%s: pci_region = %d", __func__, pci_region);
return 1;
}
+ assert(guest_end - pci_start <= memory_region_size(mr));
virt_start = (intptr_t)memory_region_get_ram_ptr(mr);
memslot.slot_id = slot_id;