cf91b1dfd9
CVE-2016-4952 scsi: pvscsi: out-of-bounds access issue CVE-2016-4964: scsi: mptsas infinite loop (bz #1339157) CVE-2016-5106: scsi: megasas: out-of-bounds write (bz #1339581) CVE-2016-5105: scsi: megasas: stack information leakage (bz #1339585) CVE-2016-5107: scsi: megasas: out-of-bounds read (bz #1339573) CVE-2016-4454: display: vmsvga: out-of-bounds read (bz #1340740) CVE-2016-4453: display: vmsvga: infinite loop (bz #1340744) CVE-2016-5126: block: iscsi: buffer overflow (bz #1340925) CVE-2016-5238: scsi: esp: OOB write (bz #1341932) CVE-2016-5338: scsi: esp: OOB r/w access (bz #1343325) CVE-2016-5337: scsi: megasas: information leakage (bz #1343910) Fix crash with -nodefaults -sdl (bz #1340931) Add deps on edk2-ovmf and edk2-aarch64
43 lines
1.5 KiB
Diff
43 lines
1.5 KiB
Diff
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Mon, 30 May 2016 09:09:21 +0200
|
|
Subject: [PATCH] vmsvga: don't process more than 1024 fifo commands at once
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
vmsvga_fifo_run is called in regular intervals (on each display update)
|
|
and will resume where it left off. So we can simply exit the loop,
|
|
without having to worry about how processing will continue.
|
|
|
|
Fixes: CVE-2016-4453
|
|
Cc: qemu-stable@nongnu.org
|
|
Cc: P J P <ppandit@redhat.com>
|
|
Reported-by: 李强 <liqiang6-s@360.cn>
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com
|
|
(cherry picked from commit 4e68a0ee17dad7b8d870df0081d4ab2e079016c2)
|
|
---
|
|
hw/display/vmware_vga.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
|
|
index de2567b..e51a05e 100644
|
|
--- a/hw/display/vmware_vga.c
|
|
+++ b/hw/display/vmware_vga.c
|
|
@@ -597,13 +597,13 @@ static inline uint32_t vmsvga_fifo_read(struct vmsvga_state_s *s)
|
|
static void vmsvga_fifo_run(struct vmsvga_state_s *s)
|
|
{
|
|
uint32_t cmd, colour;
|
|
- int args, len;
|
|
+ int args, len, maxloop = 1024;
|
|
int x, y, dx, dy, width, height;
|
|
struct vmsvga_cursor_definition_s cursor;
|
|
uint32_t cmd_start;
|
|
|
|
len = vmsvga_fifo_length(s);
|
|
- while (len > 0) {
|
|
+ while (len > 0 && --maxloop > 0) {
|
|
/* May need to go back to the start of the command if incomplete */
|
|
cmd_start = s->fifo_stop;
|
|
|