From patchwork Mon May 30 07:09:21 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 9140317 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5FAD660759 for ; Mon, 30 May 2016 07:12:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 513D7280B2 for ; Mon, 30 May 2016 07:12:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 45971281FE; Mon, 30 May 2016 07:12:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.9 required=2.0 tests=BAYES_00,FSL_HELO_HOME, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id C280E280B2 for ; Mon, 30 May 2016 07:12:29 +0000 (UTC) Received: from localhost ([::1]:58243 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b7HNE-0001St-SY for patchwork-qemu-devel@patchwork.kernel.org; Mon, 30 May 2016 03:12:28 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50047) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b7HKY-0008CI-Mr for qemu-devel@nongnu.org; Mon, 30 May 2016 03:09:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1b7HKR-0001mA-DJ for qemu-devel@nongnu.org; Mon, 30 May 2016 03:09:42 -0400 Received: from mx1.redhat.com ([209.132.183.28]:54626) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b7HKR-0001lP-8E for qemu-devel@nongnu.org; Mon, 30 May 2016 03:09:35 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id E39AD6265B; Mon, 30 May 2016 07:09:32 +0000 (UTC) Received: from nilsson.home.kraxel.org (ovpn-116-35.ams2.redhat.com [10.36.116.35]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u4U79VRD029614; Mon, 30 May 2016 03:09:32 -0400 Received: by nilsson.home.kraxel.org (Postfix, from userid 500) id 9695682514; Mon, 30 May 2016 09:09:31 +0200 (CEST) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Mon, 30 May 2016 09:09:21 +0200 Message-Id: <1464592161-18348-5-git-send-email-kraxel@redhat.com> In-Reply-To: <1464592161-18348-1-git-send-email-kraxel@redhat.com> References: <1464592161-18348-1-git-send-email-kraxel@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Mon, 30 May 2016 07:09:33 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH 4/4] vmsvga: don't process more than 1024 fifo commands at once X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?=E6=9D=8E=E5=BC=BA?= , Gerd Hoffmann , P J P Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP vmsvga_fifo_run is called in regular intervals (on each display update) and will resume where it left off. So we can simply exit the loop, without having to worry about how processing will continue. Fixes: CVE-2016-4453 Cc: P J P Reported-by: 李强 Signed-off-by: Gerd Hoffmann --- hw/display/vmware_vga.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c index de2567b..e51a05e 100644 --- a/hw/display/vmware_vga.c +++ b/hw/display/vmware_vga.c @@ -597,13 +597,13 @@ static inline uint32_t vmsvga_fifo_read(struct vmsvga_state_s *s) static void vmsvga_fifo_run(struct vmsvga_state_s *s) { uint32_t cmd, colour; - int args, len; + int args, len, maxloop = 1024; int x, y, dx, dy, width, height; struct vmsvga_cursor_definition_s cursor; uint32_t cmd_start; len = vmsvga_fifo_length(s); - while (len > 0) { + while (len > 0 && --maxloop > 0) { /* May need to go back to the start of the command if incomplete */ cmd_start = s->fifo_stop;