From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41856) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bWrk9-00041B-HY for qemu-devel@nongnu.org; Mon, 08 Aug 2016 17:05:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bWrk6-0005wu-7L for qemu-devel@nongnu.org; Mon, 08 Aug 2016 17:05:53 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:43591) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bWrk5-0005wV-V6 for qemu-devel@nongnu.org; Mon, 08 Aug 2016 17:05:50 -0400 Received: from pps.filterd (m0098396.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.11/8.16.0.11) with SMTP id u78Kxkp3100181 for ; Mon, 8 Aug 2016 17:05:49 -0400 Received: from e19.ny.us.ibm.com (e19.ny.us.ibm.com [129.33.205.209]) by mx0a-001b2d01.pphosted.com with ESMTP id 24na7fuq83-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 08 Aug 2016 17:05:49 -0400 Received: from localhost by e19.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 8 Aug 2016 17:05:48 -0400 From: Michael Roth Date: Mon, 8 Aug 2016 16:04:00 -0500 In-Reply-To: <1470690267-31454-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1470690267-31454-1-git-send-email-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Message-Id: <1470690267-31454-30-git-send-email-mdroth@linux.vnet.ibm.com> Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH 29/56] vmsvga: don't process more than 1024 fifo commands at once List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Gerd Hoffmann , P J P From: Gerd Hoffmann vmsvga_fifo_run is called in regular intervals (on each display update) and will resume where it left off. So we can simply exit the loop, without having to worry about how processing will continue. Fixes: CVE-2016-4453 Cc: qemu-stable@nongnu.org Cc: P J P Reported-by: =E6=9D=8E=E5=BC=BA Signed-off-by: Gerd Hoffmann Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com (cherry picked from commit 4e68a0ee17dad7b8d870df0081d4ab2e079016c2) Signed-off-by: Michael Roth --- hw/display/vmware_vga.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c index de2567b..e51a05e 100644 --- a/hw/display/vmware_vga.c +++ b/hw/display/vmware_vga.c @@ -597,13 +597,13 @@ static inline uint32_t vmsvga_fifo_read(struct vmsv= ga_state_s *s) static void vmsvga_fifo_run(struct vmsvga_state_s *s) { uint32_t cmd, colour; - int args, len; + int args, len, maxloop =3D 1024; int x, y, dx, dy, width, height; struct vmsvga_cursor_definition_s cursor; uint32_t cmd_start; =20 len =3D vmsvga_fifo_length(s); - while (len > 0) { + while (len > 0 && --maxloop > 0) { /* May need to go back to the start of the command if incomplete= */ cmd_start =3D s->fifo_stop; =20 --=20 1.9.1