@samitouri / QOSamiQemu / commits / f604b807a5

hw/display/vmware_vga: Don't allow guest to trigger long running loop in host

The code in the SVGA_CMD_DEFINE_ALPHA_CURSOR handler in vmsvga_fifo_run() basically does: x = vmsvga_fifo_read(s); y = vmsvga_fifo_read(s); args = x * y; goto badcmd; ... badcmd: len -= args; if (len < 0) { goto rewind; } while (args--) { vmsvga_fifo_read(s); } Thus by supplying huge values for x and y that overflow the result of the multiplication, the guest can trigger a long-running loop here that burns the host's CPU cycles. Add some sanity checks so that this cannot happen anymore. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3782 Reported-by: Feifan Qian <bea1e@proton.me> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4026 Reported-by: Tristan Madani <tristan@talencesecurity.com> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4076 Reported-by: Sunday Jiang Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

Thomas Huth committed Jul 23, 2026 at 14:44 UTC f604b807a55acd3f81725bb7dbd98450c96adf00

1 file changed +5 -1

hw/display/vmware_vga.c

+5 -1

@@ -737,6 +737,10 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)

737 vmsvga_fifo_read(s);

738 x = vmsvga_fifo_read(s);

739 y = vmsvga_fifo_read(s);

740 + if (x < 0 || x >= SVGA_MAX_WIDTH ||

741 + y < 0 || y >= SVGA_MAX_HEIGHT) {

742 + goto rewind;

743 + }

744 args = x * y;

745 goto badcmd;

746 case SVGA_CMD_RECT_ROP_FILL:

@@ -776,7 +780,7 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)

780 if (len < 0) {

781 goto rewind;

782 }

779 - while (args--) {

783 + while (args-- > 0) {

784 vmsvga_fifo_read(s);

785 }

786 printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",