[Qemu-devel] Re: [PATCH to consider for 0.12] vmware_vga: Don't crash on too-big DEFINE_CURSOR command

[Anthony Liguori <anthony@codemonkey.ws>]

Roland Dreier wrote:
>  > His last patch has the same fix without the printf().  The printf is
>  > probably something to avoid since a malicious guest could create a
>  > storm of them.  Since libvirt logs stderr by default, the result could
>  > be pretty nasty.
>
> By the way, are the
>
>         fprintf(stderr, "%s: update width too large x: %d, w: %d\n",
>                         __FUNCTION__, x, w);
>
>         fprintf(stderr, "%s: update height too large y: %d, h: %d\n",
>                         __FUNCTION__, y, h);
>
> prints triggerable by a guest?  (I think so -- if so I can send a patch
> removing them if you want)
>
> How about the printf()s to stdout?  eg a guest can cause a flood of the
>
>             printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",
>                             __FUNCTION__, cmd);
>
> or
>
>             printf("%s: guest runs %s.\n", __FUNCTION__,
>                             vmsvga_guest_id[value - GUEST_OS_BASE]);
>
> output if it wants pretty trivially.
>   
Yeah, that's all stuff that needs to go.

Regards,

Anthony Liguori