|
 |
cf91b1d |
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
cf91b1d |
Date: Mon, 30 May 2016 09:09:21 +0200
|
|
|
cf91b1d |
Subject: [PATCH] vmsvga: don't process more than 1024 fifo commands at once
|
|
|
cf91b1d |
MIME-Version: 1.0
|
|
|
cf91b1d |
Content-Type: text/plain; charset=UTF-8
|
|
|
cf91b1d |
Content-Transfer-Encoding: 8bit
|
|
|
cf91b1d |
|
|
|
cf91b1d |
vmsvga_fifo_run is called in regular intervals (on each display update)
|
|
|
cf91b1d |
and will resume where it left off. So we can simply exit the loop,
|
|
|
cf91b1d |
without having to worry about how processing will continue.
|
|
|
cf91b1d |
|
|
|
cf91b1d |
Fixes: CVE-2016-4453
|
|
|
cf91b1d |
Cc: qemu-stable@nongnu.org
|
|
|
cf91b1d |
Cc: P J P <ppandit@redhat.com>
|
|
|
cf91b1d |
Reported-by: 李强 <liqiang6-s@360.cn>
|
|
|
cf91b1d |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
cf91b1d |
Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com
|
|
|
cf91b1d |
(cherry picked from commit 4e68a0ee17dad7b8d870df0081d4ab2e079016c2)
|
|
|
cf91b1d |
---
|
|
|
cf91b1d |
hw/display/vmware_vga.c | 4 ++--
|
|
|
cf91b1d |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
cf91b1d |
|
|
|
cf91b1d |
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
|
|
|
cf91b1d |
index de2567b..e51a05e 100644
|
|
|
cf91b1d |
--- a/hw/display/vmware_vga.c
|
|
|
cf91b1d |
+++ b/hw/display/vmware_vga.c
|
|
|
cf91b1d |
@@ -597,13 +597,13 @@ static inline uint32_t vmsvga_fifo_read(struct vmsvga_state_s *s)
|
|
|
cf91b1d |
static void vmsvga_fifo_run(struct vmsvga_state_s *s)
|
|
|
cf91b1d |
{
|
|
|
cf91b1d |
uint32_t cmd, colour;
|
|
|
cf91b1d |
- int args, len;
|
|
|
cf91b1d |
+ int args, len, maxloop = 1024;
|
|
|
cf91b1d |
int x, y, dx, dy, width, height;
|
|
|
cf91b1d |
struct vmsvga_cursor_definition_s cursor;
|
|
|
cf91b1d |
uint32_t cmd_start;
|
|
|
cf91b1d |
|
|
|
cf91b1d |
len = vmsvga_fifo_length(s);
|
|
|
cf91b1d |
- while (len > 0) {
|
|
|
cf91b1d |
+ while (len > 0 && --maxloop > 0) {
|
|
|
cf91b1d |
/* May need to go back to the start of the command if incomplete */
|
|
|
cf91b1d |
cmd_start = s->fifo_stop;
|
|
|
cf91b1d |
|