Gerd Hoffmann 5213602678 vmsvga: move fifo sanity checks to vmsvga_fifo_length ...

Sanity checks are applied when the fifo is enabled by the guest
(SVGA_REG_CONFIG_DONE write).  Which doesn't help much if the guest
changes the fifo registers afterwards.  Move the checks to
vmsvga_fifo_length so they are done each time qemu is about to read
from the fifo.

Fixes: CVE-2016-4454
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-2-git-send-email-kraxel@redhat.com

2016-06-06 09:03:51 +02:00

..

ads7846.c

…

bcm2835_fb.c

hw: explicitly include qemu/log.h

2016-05-19 16:42:29 +02:00

blizzard.c

hw/display/blizzard: Remove blizzard_template.h

2016-05-12 13:22:30 +01:00

cg3.c

hw: explicitly include qemu/log.h

2016-05-19 16:42:29 +02:00

cirrus_vga_rop2.h

…

cirrus_vga_rop.h

…

cirrus_vga.c

…

exynos4210_fimd.c

hw/display: QOM'ify exynos4210_fimd.c

2016-05-12 13:22:27 +01:00

framebuffer.c

…

framebuffer.h

…

g364fb.c

…

jazz_led.c

hw/display: QOM'ify jazz_led.c

2016-05-13 09:33:38 +01:00

Makefile.objs

…

milkymist-tmu2.c

…

milkymist-vgafb_template.h

…

milkymist-vgafb.c

…

omap_dss.c

…

omap_lcd_template.h

omap_lcdc: Remove support for DEPTH != 32

2016-05-12 13:22:24 +01:00

omap_lcdc.c

omap_lcdc: Remove support for DEPTH != 32

2016-05-12 13:22:24 +01:00

pl110_template.h

…

pl110.c

hw: explicitly include qemu/log.h

2016-05-19 16:42:29 +02:00

pxa2xx_lcd.c

…

pxa2xx_template.h

…

qxl-logger.c

…

qxl-render.c

…

qxl.c

…

qxl.h

…

sm501_template.h

…

sm501.c

…

ssd0303.c

…

ssd0323.c

…

tc6393xb_template.h

…

tc6393xb.c

qemu-common: stop including qemu/host-utils.h from qemu-common.h

2016-05-19 16:42:28 +02:00

tcx.c

…

vga_int.h

vga: add sr_vbe register set

2016-05-23 14:28:25 +02:00

vga-helpers.h

…

vga-isa-mm.c

…

vga-isa.c

…

vga-pci.c

…

vga.c

vga: add sr_vbe register set

2016-05-23 14:28:25 +02:00

vga.h

…

virtio-gpu-3d.c

virtio-gpu: check max_outputs only

2016-05-23 13:30:03 +02:00

virtio-gpu-pci.c

…

virtio-gpu.c

virtio-gpu: fix scanout rectangles

2016-06-03 09:05:28 +02:00

virtio-vga.c

virtio-vga: propagate on gpu realized error

2016-05-23 13:30:03 +02:00

vmware_vga.c

vmsvga: move fifo sanity checks to vmsvga_fifo_length

2016-06-06 09:03:51 +02:00

xenfb.c

…