From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 29 Apr 2020 11:52:35 +0000 (+0200)
Subject: ramfb: add sanity checks to ramfb_create_display_surface
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=819c83e27895472befbfee67d3d7d089c61d7fbd;p=qemu.git

ramfb: add sanity checks to ramfb_create_display_surface

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 20200429115236.28709-6-kraxel@redhat.com
---

diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c
index 1a20bdec41..52dae78db4 100644
--- a/hw/display/ramfb.c
+++ b/hw/display/ramfb.c
@@ -15,6 +15,7 @@
 #include "qapi/error.h"
 #include "hw/loader.h"
 #include "hw/display/ramfb.h"
+#include "hw/display/bochs-vbe.h" /* for limits */
 #include "ui/console.h"
 #include "sysemu/reset.h"
 
@@ -49,6 +50,11 @@ static DisplaySurface *ramfb_create_display_surface(int width, int height,
     hwaddr size;
     void *data;
 
+    if (width < 16 || width > VBE_DISPI_MAX_XRES ||
+        height < 16 || height > VBE_DISPI_MAX_YRES ||
+        format == 0 /* unknown format */)
+        return NULL;
+
     if (linesize == 0) {
         linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
     }