Commit f604b807a5 for qemu.org

commit f604b807a55acd3f81725bb7dbd98450c96adf00
Author: Thomas Huth <thuth@redhat.com>
Date:   Thu Jul 23 14:44:32 2026 +0200

    hw/display/vmware_vga: Don't allow guest to trigger long running loop in host

    The code in the SVGA_CMD_DEFINE_ALPHA_CURSOR handler in vmsvga_fifo_run()
    basically does:

                x = vmsvga_fifo_read(s);
                y = vmsvga_fifo_read(s);
                args = x * y;
                goto badcmd;
                ...
    badcmd:
                len -= args;
                if (len < 0) {
                    goto rewind;
                }
                while (args--) {
                    vmsvga_fifo_read(s);
                }

    Thus by supplying huge values for x and y that overflow the result of
    the multiplication, the guest can trigger a long-running loop here
    that burns the host's CPU cycles.

    Add some sanity checks so that this cannot happen anymore.

    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3782
    Reported-by: Feifan Qian <bea1e@proton.me>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4026
    Reported-by: Tristan Madani <tristan@talencesecurity.com>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4076
    Reported-by: Sunday Jiang
    Signed-off-by: Thomas Huth <thuth@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
    Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index f6f9edfd1d..567806f0e4 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -737,6 +737,10 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
             vmsvga_fifo_read(s);
             x = vmsvga_fifo_read(s);
             y = vmsvga_fifo_read(s);
+            if (x < 0 || x >= SVGA_MAX_WIDTH ||
+                y < 0 || y >= SVGA_MAX_HEIGHT) {
+                goto rewind;
+            }
             args = x * y;
             goto badcmd;
         case SVGA_CMD_RECT_ROP_FILL:
@@ -776,7 +780,7 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
             if (len < 0) {
                 goto rewind;
             }
-            while (args--) {
+            while (args-- > 0) {
                 vmsvga_fifo_read(s);
             }
             printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",