[09/29] vmsvga: Account for length of command word when parsing commands

Commit Message

Liran Alon Aug. 9, 2018, 11:46 a.m. UTC

From: Leonid Shatz <[e-mail]>

While we continue to ignore SVGA_CMD_RECT_ROP_FILL, SVGA_CMD_RECT_ROP_COPY
and SVGA_CMD_FENCE commands, we should account for command length, not only
arguments following command code.

Signed-off-by: Leonid Shatz <[e-mail]>
Reviewed-by: Darren Kenny <[e-mail]>
Signed-off-by: Liran Alon <[e-mail]>
---
 hw/display/vmware_vga.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

Patch

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 675c8755ab48..b32a625ae9c2 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -731,9 +731,17 @@  static void vmsvga_fifo_run(struct vmsvga_state_s *s)
          * arguments so we can avoid FIFO desync
          */
         case SVGA_CMD_RECT_ROP_FILL: /* deprecated */
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 6;
             goto badcmd;
         case SVGA_CMD_RECT_ROP_COPY: /* deprecated */
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 7;
             goto badcmd;
         case SVGA_CMD_DEFINE_ALPHA_CURSOR:
@@ -761,6 +769,10 @@  static void vmsvga_fifo_run(struct vmsvga_state_s *s)
             args = 12;
             goto badcmd;
         case SVGA_CMD_FENCE:
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 1;
             goto badcmd;