| commit | fa892e9abb728e76afcf27323ab29c57fb0fe7aa | |
| author | Mauro Matteo Cascella <mcascell@redhat.com> | |
| Thu, 7 Apr 2022 08:17:12 +0000 (7 10:17 +0200) | ||
| committer | Gerd Hoffmann <kraxel@redhat.com> | |
| Thu, 7 Apr 2022 10:30:54 +0000 (7 12:30 +0200) | ||
| tree | 2e3db9e407e4559f313700a8912e431cf96a5880 | treesnapshot (tar.gz zip) |
| parent | 9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895 | commitdiff |
ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)
Prevent potential integer overflow by limiting 'width' and 'height' to
512x512. Also change 'datasize' type to size_t. Refer to security
advisory https://starlabs.sg/advisories/22-4206/ for more information.
Fixes: CVE-2021-4206
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Prevent potential integer overflow by limiting 'width' and 'height' to
512x512. Also change 'datasize' type to size_t. Refer to security
advisory https://starlabs.sg/advisories/22-4206/ for more information.
Fixes: CVE-2021-4206
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| hw/display/qxl-render.c | diffblobblamehistory | |
| hw/display/vmware_vga.c | diffblobblamehistory | |
| ui/cursor.c | diffblobblamehistory |