vmsvga: move fifo sanity checks to vmsvga_fifo_length
authorGerd Hoffmann <kraxel@redhat.com>
Mon, 30 May 2016 07:09:18 +0000 (09:09 +0200)
committerGerd Hoffmann <kraxel@redhat.com>
Mon, 6 Jun 2016 07:03:51 +0000 (09:03 +0200)
commit521360267876d3b6518b328051a2e56bca55bef8
tree7be9455891cb2cabe609ea3a1dff3119d2eece15
parentfa06e5cb7b10230e241477b13cb0beefa0d0c91e
vmsvga: move fifo sanity checks to vmsvga_fifo_length

Sanity checks are applied when the fifo is enabled by the guest
(SVGA_REG_CONFIG_DONE write).  Which doesn't help much if the guest
changes the fifo registers afterwards.  Move the checks to
vmsvga_fifo_length so they are done each time qemu is about to read
from the fifo.

Fixes: CVE-2016-4454
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-2-git-send-email-kraxel@redhat.com
hw/display/vmware_vga.c