------------------------------------------------------------------------

*From*: 	Gerd Hoffmann

*Subject*: 	[Qemu-devel] [PATCH 2/4] vmsvga: add more fifo checks

*Date*: 	Mon, 30 May 2016 09:09:19 +0200

------------------------------------------------------------------------

Make sure all fifo ptrs are within range.

Fixes: CVE-2016-4454

Cc: P J P <address@hidden>

Reported-by: 李强 <address@hidden>

Signed-off-by: Gerd Hoffmann <address@hidden>

---

 hw/display/vmware_vga.c | 5 ++++-

 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/qemu-xen/hw/display/vmware_vga.c b/hw/display/vmware_vga.c

index 63a7c05..a26e62e 100644

--- a/tools/qemu-xen/hw/display/vmware_vga.c

+++ b/tools/qemu-xen/hw/display/vmware_vga.c

@@ -563,7 +563,10 @@ static inline int vmsvga_fifo_length(struct vmsvga_state_s *s)

     if (CMD(min) < (uint8_t *) s->cmd->fifo - (uint8_t *) s->fifo) {

         return 0;

     }

-    if (CMD(max) > SVGA_FIFO_SIZE) {

+    if (CMD(max) > SVGA_FIFO_SIZE ||

+        CMD(min) >= SVGA_FIFO_SIZE ||

+        CMD(stop) >= SVGA_FIFO_SIZE ||

+        CMD(next_cmd) >= SVGA_FIFO_SIZE) {

         return 0;

     }

     if (CMD(max) < CMD(min) + 10 * 1024) {

-- 

1.8.3.1