qemu-irix/hw
Gerd Hoffmann d59d37dea4 vmsvga: don't process more than 1024 fifo commands at once
vmsvga_fifo_run is called in regular intervals (on each display update)
and will resume where it left off.  So we can simply exit the loop,
without having to worry about how processing will continue.

Fixes: CVE-2016-4453
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com
(cherry picked from commit 4e68a0ee17)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05 13:37:49 -05:00
..
9pfs util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
acpi Revert "acpi: mark PMTIMER as unlocked" 2016-05-02 17:19:13 +01:00
alpha util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
arm hw/arm/boot: always clear r0 when booting kernels 2016-04-21 12:10:17 +01:00
audio Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
block Fix pflash migration 2016-04-15 17:27:34 +02:00
bt util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
char cadence_uart: bounds check write offset 2016-04-19 11:13:59 +01:00
core Sort the fw_cfg file list 2016-04-07 19:57:33 +03:00
cpu include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
cris util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
display vmsvga: don't process more than 1024 fifo commands at once 2016-08-05 13:37:49 -05:00
dma Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
gpio hw/gpio: Add the emulation of gpio_key 2016-03-30 17:27:22 +01:00
i2c i.MX: Add missing descriptions in devices. 2016-03-16 17:42:18 +00:00
i386 i386: kvmvapic: initialise imm32 variable 2016-08-04 15:52:54 -05:00
ide ide: really restart pending and in-flight atapi dma 2016-04-12 18:48:15 -04:00
input virtio-input: support absolute axis config in pass-through 2016-04-13 17:26:12 +02:00
intc Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
ipack include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
ipmi include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
isa hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
lm32 util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
m68k hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
mem include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
microblaze util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
mips hw/mips/cps: enable ITU for multithreading processors 2016-03-30 09:14:00 +01:00
misc cuda: fix off-by-one error in SET_TIME command 2016-04-19 11:39:23 +10:00
moxie hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
net net: stellaris_enet: check packet length against receive buffer 2016-04-11 14:22:33 +01:00
nvram Sort the fw_cfg file list 2016-04-07 19:57:33 +03:00
openrisc hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
pci util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
pci-bridge hw/pci-bridge: Add missing unref in case register-bus fails 2016-04-07 19:57:33 +03:00
pci-host include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
pcmcia hw: Clean up includes 2016-01-29 15:07:25 +00:00
ppc spapr_drc: fix aborts during DRC-count based hotplug 2016-04-26 11:16:08 +10:00
s390x hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
scsi scsi: mptsas: infinite loop while fetching requests 2016-08-05 13:32:04 -05:00
sd Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
sh4 hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
smbios include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
sparc util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
sparc64 util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
ssi hw: Clean up includes 2016-01-29 15:07:25 +00:00
timer hw/timer: Revert "hpet: inverse polarity when pin above ISA_NUM_IRQS" 2016-04-08 00:07:43 +02:00
tpm tpm: Fix write to file descriptor function 2016-04-13 19:52:34 +03:00
tricore hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
unicore32 hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
usb usb/ohci: Fix crash with when specifying too many num-ports 2016-08-04 16:43:40 -05:00
vfio vfio: Fix broken EEH 2016-08-05 13:23:19 -05:00
virtio virtio: Mark host notifiers as external 2016-04-22 16:43:58 +02:00
watchdog util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
xen util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
xenpv xen: Clean up includes 2016-01-29 15:07:23 +00:00
xtensa hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
Makefile.objs