qemu-irix/hw/display
Gerd Hoffmann d59d37dea4 vmsvga: don't process more than 1024 fifo commands at once
vmsvga_fifo_run is called in regular intervals (on each display update)
and will resume where it left off.  So we can simply exit the loop,
without having to worry about how processing will continue.

Fixes: CVE-2016-4453
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com
(cherry picked from commit 4e68a0ee17)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05 13:37:49 -05:00
..
Makefile.objs bcm2835_fb: add framebuffer device for Raspberry Pi 2016-03-16 17:42:18 +00:00
ads7846.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
bcm2835_fb.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
blizzard.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
blizzard_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
cg3.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
cirrus_vga.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
cirrus_vga_rop.h cirrus: Fix host CPU blits 2014-07-11 10:17:02 +02:00
cirrus_vga_rop2.h hw: move private headers to hw/ subdirectories. 2013-04-08 18:13:16 +02:00
exynos4210_fimd.c arm: Clean up includes 2016-01-29 15:07:23 +00:00
framebuffer.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
framebuffer.h framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer 2015-07-24 13:57:45 +02:00
g364fb.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
jazz_led.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
milkymist-tmu2.c lm32: Clean up includes 2016-01-29 15:07:22 +00:00
milkymist-vgafb.c lm32: Clean up includes 2016-01-29 15:07:22 +00:00
milkymist-vgafb_template.h milkymist-vgafb: swap pixel data in source buffer 2014-02-04 19:34:30 +01:00
omap_dss.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
omap_lcd_template.h arm: explicitly mark device loads as little-endian 2015-12-17 13:37:13 +00:00
omap_lcdc.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
pl110.c arm: Clean up includes 2016-01-29 15:07:23 +00:00
pl110_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
pxa2xx_lcd.c arm: Clean up includes 2016-01-29 15:07:23 +00:00
pxa2xx_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
qxl-logger.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
qxl-render.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
qxl.c qxl: lock current_async update in qxl_soft_reset 2016-03-01 07:51:32 +01:00
qxl.h qxl: allow to specify head limit to qxl driver 2015-07-16 17:31:05 +02:00
sm501.c hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
sm501_template.h hw: use ld_p/st_p instead of ld_raw/st_raw 2014-06-05 16:04:17 +02:00
ssd0303.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
ssd0323.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
tc6393xb.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
tc6393xb_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
tcx.c hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
vga-helpers.h vga: Rename vga_template.h to vga-helpers.h 2014-09-30 13:34:09 +02:00
vga-isa-mm.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
vga-isa.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
vga-pci.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
vga.c vga: add sr_vbe register set 2016-08-04 16:46:46 -05:00
vga.h hw: move private headers to hw/ subdirectories. 2013-04-08 18:13:16 +02:00
vga_int.h vga: add sr_vbe register set 2016-08-04 16:46:46 -05:00
virtio-gpu-3d.c virtio-gpu: block any rendering until client (ui) is done 2016-02-03 10:41:36 +01:00
virtio-gpu-pci.c virtio: Clean up includes 2016-01-29 15:07:23 +00:00
virtio-gpu.c virtio-gpu: block live migration 2016-04-11 12:36:34 +02:00
virtio-vga.c virtio-gpu: block any rendering until client (ui) is done 2016-02-03 10:41:36 +01:00
vmware_vga.c vmsvga: don't process more than 1024 fifo commands at once 2016-08-05 13:37:49 -05:00
xenfb.c xenfb: use the correct condition to avoid excessive looping 2016-04-12 10:16:08 -07:00