vga: stop passing pointers to vga_draw_line* functions

vga: stop passing pointers to vga_draw_line* functions

Instead pass around the address (aka offset into vga memory).
Add vga_read_* helper functions which apply vbe_size_mask to
the address, to make sure the address stays within the valid
range, similar to the cirrus blitter fixes (commits ffaf857778
and 026aeffcb4).

Impact:  DoS for privileged guest users.  qemu crashes with
a segfault, when hitting the guard page after vga memory
allocation, while reading vga memory for display updates.

Fixes: CVE-2017-13672
Cc: P J P <[email protected]>
Reported-by: David Buchanan <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>
Message-id: 20170828122906[email protected]