Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:GA
xen.5015
CVE-2017-2633-qemuu-VNC-memory-corruption-due-t...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2017-2633-qemuu-VNC-memory-corruption-due-to-unchecked-resolution-limit.patch of Package xen.5015
References: bsc#1026636 CVE-2017-2633 Subject: ui/vnc: fix potential memory corruption issues From: Peter Lieven pl@kamp.de Mon Jun 30 10:57:51 2014 +0200 Date: Tue Jul 1 13:26:40 2014 +0200: Git: bea60dd7679364493a0d7f5b54316c767cf894ef this patch makes the VNC server work correctly if the server surface and the guest surface have different sizes. Basically the server surface is adjusted to not exceed VNC_MAX_WIDTH x VNC_MAX_HEIGHT and additionally the width is rounded up to multiple of VNC_DIRTY_PIXELS_PER_BIT. If we have a resolution whose width is not dividable by VNC_DIRTY_PIXELS_PER_BIT we now get a small black bar on the right of the screen. If the surface is too big to fit the limits only the upper left area is shown. On top of that this fixes 2 memory corruption issues: The first was actually discovered during playing around with a Windows 7 vServer. During resolution change in Windows 7 it happens sometimes that Windows changes to an intermediate resolution where server_stride % cmp_bytes != 0 (in vnc_refresh_server_surface). This happens only if width % VNC_DIRTY_PIXELS_PER_BIT != 0. The second is a theoretical issue, but is maybe exploitable by the guest. If for some reason the guest surface size is bigger than VNC_MAX_WIDTH x VNC_MAX_HEIGHT we end up in severe corruption since this limit is nowhere enforced. This patch also includes the following commits: b4c85ddcec24c60616aad9b3b7fc36ce19ba3ca4 919372251cbfa9e43b0264fec475dd1eca23784f 12b316d4c173bf07f421ef9dc98ba4b53916066e 2f487a3d40faff1772e14da6b921900915501f9a 6cd859aa8a7fb60fe6edb89e628cddfe25dfe186 Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/ui/vnc.c =================================================================== --- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/ui/vnc.c +++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/ui/vnc.c @@ -427,32 +427,35 @@ static void framebuffer_update_request(V static void vnc_refresh(DisplayChangeListener *dcl); static int vnc_refresh_server_surface(VncDisplay *vd); +static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], + VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT), + int width, int height, + int x, int y, int w, int h) { + /* this is needed this to ensure we updated all affected + * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */ + w += (x % VNC_DIRTY_PIXELS_PER_BIT); + x -= (x % VNC_DIRTY_PIXELS_PER_BIT); + + x = MIN(x, width); + y = MIN(y, height); + w = MIN(x + w, width) - x; + h = MIN(y + h, height); + + for (; y < h; y++) { + bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT, + DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT)); + } +} + static void vnc_dpy_update(DisplayChangeListener *dcl, int x, int y, int w, int h) { - int i; VncDisplay *vd = container_of(dcl, VncDisplay, dcl); struct VncSurface *s = &vd->guest; - int width = surface_width(vd->ds); - int height = surface_height(vd->ds); - - h += y; - - /* round x down to ensure the loop only spans one 16-pixel block per, - iteration. otherwise, if (x % 16) != 0, the last iteration may span - two 16-pixel blocks but we only mark the first as dirty - */ - w += (x % 16); - x -= (x % 16); + int width = pixman_image_get_width(vd->server); + int height = pixman_image_get_height(vd->server); - x = MIN(x, width); - y = MIN(y, height); - w = MIN(x + w, width) - x; - h = MIN(h, height); - - for (; y < h; y++) - for (i = 0; i < w; i += 16) - set_bit((x + i) / 16, s->dirty[y]); + vnc_set_area_dirty(s->dirty, width, height, x, y, w, h); } void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h, @@ -516,17 +519,15 @@ void buffer_advance(Buffer *buf, size_t static void vnc_desktop_resize(VncState *vs) { - DisplaySurface *ds = vs->vd->ds; - if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) { return; } - if (vs->client_width == surface_width(ds) && - vs->client_height == surface_height(ds)) { + if (vs->client_width == pixman_image_get_width(vs->vd->server) && + vs->client_height == pixman_image_get_height(vs->vd->server)) { return; } - vs->client_width = surface_width(ds); - vs->client_height = surface_height(ds); + vs->client_width = pixman_image_get_width(vs->vd->server); + vs->client_height = pixman_image_get_height(vs->vd->server); vnc_lock_output(vs); vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); vnc_write_u8(vs, 0); @@ -576,16 +577,18 @@ static void vnc_dpy_switch(DisplayChange { VncDisplay *vd = container_of(dcl, VncDisplay, dcl); VncState *vs; + int width, height; vnc_abort_display_jobs(vd); /* server surface */ qemu_pixman_image_unref(vd->server); vd->ds = surface; + width = MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds), + VNC_DIRTY_PIXELS_PER_BIT)); + height = MIN(VNC_MAX_HEIGHT, surface_height(vd->ds)); vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT, - surface_width(vd->ds), - surface_height(vd->ds), - NULL, 0); + width, height, NULL, 0); /* guest surface */ #if 0 /* FIXME */ @@ -595,7 +598,9 @@ static void vnc_dpy_switch(DisplayChange qemu_pixman_image_unref(vd->guest.fb); vd->guest.fb = pixman_image_ref(surface->image); vd->guest.format = surface->format; - memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty)); + memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty)); + vnc_set_area_dirty(vd->guest.dirty, width, height, 0, 0, + width, height); QTAILQ_FOREACH(vs, &vd->clients, next) { vnc_colordepth(vs); @@ -603,7 +608,9 @@ static void vnc_dpy_switch(DisplayChange if (vs->vd->cursor) { vnc_cursor_define(vs); } - memset(vs->dirty, 0xFF, sizeof(vs->dirty)); + memset(vs->dirty, 0x00, sizeof(vs->dirty)); + vnc_set_area_dirty(vs->dirty, width, height, 0, 0, + width, height); } } @@ -769,11 +776,12 @@ static void vnc_dpy_copy(DisplayChangeLi y = dst_y + h - 1; inc = -1; } - w_lim = w - (16 - (dst_x % 16)); - if (w_lim < 0) + w_lim = w - (VNC_DIRTY_PIXELS_PER_BIT - (dst_x % VNC_DIRTY_PIXELS_PER_BIT)); + if (w_lim < 0) { w_lim = w; - else - w_lim = w - (w_lim % 16); + } else { + w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT); + } for (i = 0; i < h; i++) { for (x = 0; x <= w_lim; x += s, src_row += cmp_bytes, dst_row += cmp_bytes) { @@ -781,10 +789,11 @@ static void vnc_dpy_copy(DisplayChangeLi if ((s = w - w_lim) == 0) break; } else if (!x) { - s = (16 - (dst_x % 16)); + s = (VNC_DIRTY_PIXELS_PER_BIT - + (dst_x % VNC_DIRTY_PIXELS_PER_BIT)); s = MIN(s, w_lim); } else { - s = 16; + s = VNC_DIRTY_PIXELS_PER_BIT; } cmp_bytes = s * VNC_SERVER_FB_BYTES; if (memcmp(src_row, dst_row, cmp_bytes) == 0) @@ -792,7 +801,8 @@ static void vnc_dpy_copy(DisplayChangeLi memmove(dst_row, src_row, cmp_bytes); QTAILQ_FOREACH(vs, &vd->clients, next) { if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) { - set_bit(((x + dst_x) / 16), vs->dirty[y]); + set_bit(((x + dst_x) / VNC_DIRTY_PIXELS_PER_BIT), + vs->dirty[y]); } } } @@ -886,10 +896,9 @@ static int vnc_update_client(VncState *v VncDisplay *vd = vs->vd; VncJob *job; int y; - int width, height; + int height, width; int n = 0; - if (vs->output.offset && !vs->audio_cap && !vs->force_update) /* kernel send buffers are full -> drop frames to throttle */ return 0; @@ -905,32 +914,30 @@ static int vnc_update_client(VncState *v */ job = vnc_job_new(vs); - width = MIN(pixman_image_get_width(vd->server), vs->client_width); - height = MIN(pixman_image_get_height(vd->server), vs->client_height); + height = pixman_image_get_height(vd->server); + width = pixman_image_get_width(vd->server); - for (y = 0; y < height; y++) { - int x; - int last_x = -1; - for (x = 0; x < width / 16; x++) { - if (test_and_clear_bit(x, vs->dirty[y])) { - if (last_x == -1) { - last_x = x; - } - } else { - if (last_x != -1) { - int h = find_and_clear_dirty_height(vs, y, last_x, x, - height); - - n += vnc_job_add_rect(job, last_x * 16, y, - (x - last_x) * 16, h); - } - last_x = -1; - } - } - if (last_x != -1) { - int h = find_and_clear_dirty_height(vs, y, last_x, x, height); - n += vnc_job_add_rect(job, last_x * 16, y, - (x - last_x) * 16, h); + y = 0; + for (;;) { + int x, h; + unsigned long x2; + unsigned long offset = find_next_bit((unsigned long *) &vs->dirty, + height * VNC_DIRTY_BPL(vs), + y * VNC_DIRTY_BPL(vs)); + if (offset == height * VNC_DIRTY_BPL(vs)) { + /* no more dirty bits */ + break; + } + y = offset / VNC_DIRTY_BPL(vs); + x = offset % VNC_DIRTY_BPL(vs); + x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y], + VNC_DIRTY_BPL(vs), x); + bitmap_clear(vs->dirty[y], x, x2 - x); + h = find_and_clear_dirty_height(vs, y, x, x2, height); + x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT); + if (x2 > x) { + n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y, + (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h); } } @@ -1491,8 +1498,8 @@ static void check_pointer_type_change(No vnc_write_u8(vs, 0); vnc_write_u16(vs, 1); vnc_framebuffer_update(vs, absolute, 0, - surface_width(vs->vd->ds), - surface_height(vs->vd->ds), + pixman_image_get_width(vs->vd->server), + pixman_image_get_height(vs->vd->server), VNC_ENCODING_POINTER_TYPE_CHANGE); vnc_unlock_output(vs); vnc_flush(vs); @@ -1504,8 +1511,8 @@ static void pointer_event(VncState *vs, { int buttons = 0; int dz = 0; - int width = surface_width(vs->vd->ds); - int height = surface_height(vs->vd->ds); + int width = pixman_image_get_width(vs->vd->server); + int height = pixman_image_get_height(vs->vd->server); if (button_mask & 0x01) buttons |= MOUSE_EVENT_LBUTTON; @@ -1857,29 +1864,18 @@ static void ext_key_event(VncState *vs, } static void framebuffer_update_request(VncState *vs, int incremental, - int x_position, int y_position, - int w, int h) + int x, int y, int w, int h) { - int i; - const size_t width = surface_width(vs->vd->ds) / 16; - const size_t height = surface_height(vs->vd->ds); - - if (y_position > height) { - y_position = height; - } - if (y_position + h >= height) { - h = height - y_position; - } + int width = pixman_image_get_width(vs->vd->server); + int height = pixman_image_get_height(vs->vd->server); vs->need_update = 1; - if (!incremental) { - vs->force_update = 1; - for (i = 0; i < h; i++) { - bitmap_set(vs->dirty[y_position + i], 0, width); - bitmap_clear(vs->dirty[y_position + i], width, - VNC_DIRTY_BITS - width); - } + + if (incremental) { + return; } + + vnc_set_area_dirty(vs->dirty, width, height, x, y, w, h); } static void send_ext_key_event_ack(VncState *vs) @@ -1889,8 +1885,8 @@ static void send_ext_key_event_ack(VncSt vnc_write_u8(vs, 0); vnc_write_u16(vs, 1); vnc_framebuffer_update(vs, 0, 0, - surface_width(vs->vd->ds), - surface_height(vs->vd->ds), + pixman_image_get_width(vs->vd->server), + pixman_image_get_height(vs->vd->server), VNC_ENCODING_EXT_KEY_EVENT); vnc_unlock_output(vs); vnc_flush(vs); @@ -1903,8 +1899,8 @@ static void send_ext_audio_ack(VncState vnc_write_u8(vs, 0); vnc_write_u16(vs, 1); vnc_framebuffer_update(vs, 0, 0, - surface_width(vs->vd->ds), - surface_height(vs->vd->ds), + pixman_image_get_width(vs->vd->server), + pixman_image_get_height(vs->vd->server), VNC_ENCODING_AUDIO); vnc_unlock_output(vs); vnc_flush(vs); @@ -2092,8 +2088,8 @@ static void vnc_colordepth(VncState *vs) vnc_write_u8(vs, 0); vnc_write_u16(vs, 1); /* number of rects */ vnc_framebuffer_update(vs, 0, 0, - surface_width(vs->vd->ds), - surface_height(vs->vd->ds), + pixman_image_get_width(vs->vd->server), + pixman_image_get_height(vs->vd->server), VNC_ENCODING_WMVi); pixel_format_message(vs); vnc_unlock_output(vs); @@ -2315,8 +2311,8 @@ static int protocol_client_init(VncState } vnc_set_share_mode(vs, mode); - vs->client_width = surface_width(vs->vd->ds); - vs->client_height = surface_height(vs->vd->ds); + vs->client_width = pixman_image_get_width(vs->vd->server); + vs->client_height = pixman_image_get_height(vs->vd->server); vnc_write_u16(vs, vs->client_width); vnc_write_u16(vs, vs->client_height); @@ -2580,7 +2576,9 @@ static int vnc_refresh_lossy_rect(VncDis vs->lossy_rect[sty][stx] = 0; for (j = 0; j < VNC_STAT_RECT; ++j) { - bitmap_set(vs->dirty[y + j], x / 16, VNC_STAT_RECT / 16); + bitmap_set(vs->dirty[y + j], + x / VNC_DIRTY_PIXELS_PER_BIT, + VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT); } has_dirty++; } @@ -2681,12 +2679,12 @@ static void vnc_rect_updated(VncDisplay static int vnc_refresh_server_surface(VncDisplay *vd) { - int width = pixman_image_get_width(vd->guest.fb); - int height = pixman_image_get_height(vd->guest.fb); - int y; - uint8_t *guest_row; - uint8_t *server_row; - int cmp_bytes; + int width = MIN(pixman_image_get_width(vd->guest.fb), + pixman_image_get_width(vd->server)); + int height = MIN(pixman_image_get_height(vd->guest.fb), + pixman_image_get_height(vd->server)); + int cmp_bytes, server_stride, min_stride, guest_stride, y = 0; + uint8_t *guest_row0 = NULL, *server_row0; VncState *vs; int has_dirty = 0; pixman_image_t *tmpbuf = NULL; @@ -2703,47 +2701,66 @@ static int vnc_refresh_server_surface(Vn * Check and copy modified bits from guest to server surface. * Update server dirty map. */ - cmp_bytes = 64; - if (cmp_bytes > vnc_server_fb_stride(vd)) { - cmp_bytes = vnc_server_fb_stride(vd); - } + server_row0 = (uint8_t *)pixman_image_get_data(vd->server); + server_stride = guest_stride = pixman_image_get_stride(vd->server); + cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES, + server_stride); if (vd->guest.format != VNC_SERVER_FB_FORMAT) { int width = pixman_image_get_width(vd->server); tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width); + } else { + guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb); + guest_stride = pixman_image_get_stride(vd->guest.fb); } - guest_row = (uint8_t *)pixman_image_get_data(vd->guest.fb); - server_row = (uint8_t *)pixman_image_get_data(vd->server); - for (y = 0; y < height; y++) { - if (!bitmap_empty(vd->guest.dirty[y], VNC_DIRTY_BITS)) { - int x; - uint8_t *guest_ptr; - uint8_t *server_ptr; - - if (vd->guest.format != VNC_SERVER_FB_FORMAT) { - qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y); - guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf); - } else { - guest_ptr = guest_row; - } - server_ptr = server_row; + min_stride = MIN(server_stride, guest_stride); - for (x = 0; x + 15 < width; - x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { - if (!test_and_clear_bit((x / 16), vd->guest.dirty[y])) - continue; - if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0) - continue; - memcpy(server_ptr, guest_ptr, cmp_bytes); - if (!vd->non_adaptive) - vnc_rect_updated(vd, x, y, &tv); - QTAILQ_FOREACH(vs, &vd->clients, next) { - set_bit((x / 16), vs->dirty[y]); - } - has_dirty++; + for (;;) { + int x; + uint8_t *guest_ptr, *server_ptr; + unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty, + height * VNC_DIRTY_BPL(&vd->guest), + y * VNC_DIRTY_BPL(&vd->guest)); + if (offset == height * VNC_DIRTY_BPL(&vd->guest)) { + /* no more dirty bits */ + break; + } + y = offset / VNC_DIRTY_BPL(&vd->guest); + x = offset % VNC_DIRTY_BPL(&vd->guest); + + server_ptr = server_row0 + y * server_stride + x * cmp_bytes; + + if (vd->guest.format != VNC_SERVER_FB_FORMAT) { + qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y); + guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf); + } else { + guest_ptr = guest_row0 + y * guest_stride; + } + guest_ptr += x * cmp_bytes; + + for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT); + x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { + int _cmp_bytes = cmp_bytes; + if (!test_and_clear_bit(x, vd->guest.dirty[y])) { + continue; } + if ((x + 1) * cmp_bytes > min_stride) { + _cmp_bytes = min_stride - x * cmp_bytes; + } + if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) { + continue; + } + memcpy(server_ptr, guest_ptr, _cmp_bytes); + if (!vd->non_adaptive) { + vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT, + y, &tv); + } + QTAILQ_FOREACH(vs, &vd->clients, next) { + set_bit(x, vs->dirty[y]); + } + has_dirty++; } - guest_row += pixman_image_get_stride(vd->guest.fb); - server_row += pixman_image_get_stride(vd->server); + + y++; } qemu_pixman_image_unref(tmpbuf); return has_dirty; Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/ui/vnc.h =================================================================== --- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/ui/vnc.h +++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/ui/vnc.h @@ -77,12 +77,21 @@ typedef void VncSendHextileTile(VncState void *last_fg, int *has_bg, int *has_fg); -/* VNC_MAX_WIDTH must be a multiple of 16. */ -#define VNC_MAX_WIDTH 2560 +/* VNC_DIRTY_PIXELS_PER_BIT is the number of dirty pixels represented + * by one bit in the dirty bitmap, should be a power of 2 */ +#define VNC_DIRTY_PIXELS_PER_BIT 16 + +/* VNC_MAX_WIDTH must be a multiple of VNC_DIRTY_PIXELS_PER_BIT. */ + +#define VNC_MAX_WIDTH ROUND_UP(2560, VNC_DIRTY_PIXELS_PER_BIT) #define VNC_MAX_HEIGHT 2048 /* VNC_DIRTY_BITS is the number of bits in the dirty bitmap. */ -#define VNC_DIRTY_BITS (VNC_MAX_WIDTH / 16) +#define VNC_DIRTY_BITS (VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT) + +/* VNC_DIRTY_BPL (BPL = bits per line) might be greater than + * VNC_DIRTY_BITS due to alignment */ +#define VNC_DIRTY_BPL(x) (sizeof((x)->dirty) / VNC_MAX_HEIGHT * BITS_PER_BYTE) #define VNC_STAT_RECT 64 #define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT) @@ -118,7 +127,8 @@ typedef struct VncRectStat VncRectStat; struct VncSurface { struct timeval last_freq_check; - DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], VNC_MAX_WIDTH / 16); + DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], + VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT); VncRectStat stats[VNC_STAT_ROWS][VNC_STAT_COLS]; pixman_image_t *fb; pixman_format_code_t format;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
