| commit | 394647d7116703615e0c05a1710c4c77f2b5926a | |
| author | Gerd Hoffmann <kraxel@redhat.com> | |
| Mon, 30 May 2016 07:09:18 +0000 (30 09:09 +0200) | ||
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | |
| Fri, 5 Aug 2016 18:37:08 +0000 (5 13:37 -0500) | ||
| tree | 1ab6e70a469a8800326aab64acd2857d35de23e3 | treesnapshot (tar.gz zip) |
| parent | 63a396d1510084c7349f1e90ab9eb31b6ddb5718 | commitdiff |
vmsvga: move fifo sanity checks to vmsvga_fifo_length
Sanity checks are applied when the fifo is enabled by the guest
(SVGA_REG_CONFIG_DONE write). Which doesn't help much if the guest
changes the fifo registers afterwards. Move the checks to
vmsvga_fifo_length so they are done each time qemu is about to read
from the fifo.
Fixes: CVE-2016-4454
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-2-git-send-email-kraxel@redhat.com
(cherry picked from commit 521360267876d3b6518b328051a2e56bca55bef8)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Sanity checks are applied when the fifo is enabled by the guest
(SVGA_REG_CONFIG_DONE write). Which doesn't help much if the guest
changes the fifo registers afterwards. Move the checks to
vmsvga_fifo_length so they are done each time qemu is about to read
from the fifo.
Fixes: CVE-2016-4454
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-2-git-send-email-kraxel@redhat.com
(cherry picked from commit 521360267876d3b6518b328051a2e56bca55bef8)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| hw/display/vmware_vga.c | diffblobblamehistory |