diff mbox series

[09/29] vmsvga: Account for length of command word when parsing commands

Message ID 1533815202-11967-10-git-send-email-liran.alon@oracle.com
State New
Headers show
Series : vmsvga: Various fixes and enhancements | expand

Commit Message

Liran Alon Aug. 9, 2018, 11:46 a.m. UTC 
From: Leonid Shatz <leonid.shatz@oracle.com>

While we continue to ignore SVGA_CMD_RECT_ROP_FILL, SVGA_CMD_RECT_ROP_COPY
and SVGA_CMD_FENCE commands, we should account for command length, not only
arguments following command code.

Signed-off-by: Leonid Shatz <leonid.shatz@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Signed-off-by: Liran Alon <liran.alon@oracle.com>
---
 hw/display/vmware_vga.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
diff mbox series

Patch

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 675c8755ab48..b32a625ae9c2 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -731,9 +731,17 @@  static void vmsvga_fifo_run(struct vmsvga_state_s *s)
          * arguments so we can avoid FIFO desync
          */
         case SVGA_CMD_RECT_ROP_FILL: /* deprecated */
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 6;
             goto badcmd;
         case SVGA_CMD_RECT_ROP_COPY: /* deprecated */
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 7;
             goto badcmd;
         case SVGA_CMD_DEFINE_ALPHA_CURSOR:
@@ -761,6 +769,10 @@  static void vmsvga_fifo_run(struct vmsvga_state_s *s)
             args = 12;
             goto badcmd;
         case SVGA_CMD_FENCE:
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 1;
             goto badcmd;