43 lines
1.5 KiB
Diff
43 lines
1.5 KiB
Diff
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Mon, 30 May 2016 09:09:21 +0200
|
|
Subject: [PATCH] vmsvga: don't process more than 1024 fifo commands at once
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
vmsvga_fifo_run is called in regular intervals (on each display update)
|
|
and will resume where it left off. So we can simply exit the loop,
|
|
without having to worry about how processing will continue.
|
|
|
|
Fixes: CVE-2016-4453
|
|
Cc: qemu-stable@nongnu.org
|
|
Cc: P J P <ppandit@redhat.com>
|
|
Reported-by: 李强 <liqiang6-s@360.cn>
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com
|
|
(cherry picked from commit 4e68a0ee17dad7b8d870df0081d4ab2e079016c2)
|
|
---
|
|
hw/display/vmware_vga.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
|
|
index 8b9feb8..a856a97 100644
|
|
--- a/hw/display/vmware_vga.c
|
|
+++ b/hw/display/vmware_vga.c
|
|
@@ -595,13 +595,13 @@ static inline uint32_t vmsvga_fifo_read(struct vmsvga_state_s *s)
|
|
static void vmsvga_fifo_run(struct vmsvga_state_s *s)
|
|
{
|
|
uint32_t cmd, colour;
|
|
- int args, len;
|
|
+ int args, len, maxloop = 1024;
|
|
int x, y, dx, dy, width, height;
|
|
struct vmsvga_cursor_definition_s cursor;
|
|
uint32_t cmd_start;
|
|
|
|
len = vmsvga_fifo_length(s);
|
|
- while (len > 0) {
|
|
+ while (len > 0 && --maxloop > 0) {
|
|
/* May need to go back to the start of the command if incomplete */
|
|
cmd_start = s->fifo_stop;
|
|
|