File CVE-2016-4453-qemuu-vmware-vga-vmsvga-infinite-... of Package xen.3880

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2016-4453-qemuu-vmware-vga-vmsvga-infinite-loop.patch of Package xen.3880

References: bsc#982225 CVE-2016-4453

vmsvga_fifo_run is called in regular intervals (on each display update)
and will resume where it left off.  So we can simply exit the loop,
without having to worry about how processing will continue.

Fixes: CVE-2016-4453
Cc: P J P <address@hidden>
Reported-by: 李强 <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
---
 hw/display/vmware_vga.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/hw/display/vmware_vga.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/hw/display/vmware_vga.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/hw/display/vmware_vga.c
@@ -578,13 +578,13 @@ static inline uint32_t vmsvga_fifo_read(
 static void vmsvga_fifo_run(struct vmsvga_state_s *s)
 {
     uint32_t cmd, colour;
-    int args, len;
+    int args, len, maxloop = 1024;
     int x, y, dx, dy, width, height;
     struct vmsvga_cursor_definition_s cursor;
     uint32_t cmd_start;
 
     len = vmsvga_fifo_length(s);
-    while (len > 0) {
+    while (len > 0 && --maxloop > 0) {
         /* May need to go back to the start of the command if incomplete */
         cmd_start = s->cmd->stop;

Places

File CVE-2016-4453-qemuu-vmware-vga-vmsvga-infinite-loop.patch of Package xen.3880

Places