From: Leonid Shatz <leonid.shatz@oracle.com>

While we continue to ignore SVGA_CMD_RECT_ROP_FILL, SVGA_CMD_RECT_ROP_COPY
and SVGA_CMD_FENCE commands, we should account for command length, not only
arguments following command code.

Signed-off-by: Leonid Shatz <leonid.shatz@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Signed-off-by: Liran Alon <liran.alon@oracle.com>
---
 hw/display/vmware_vga.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 675c8755ab48..b32a625ae9c2 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -731,9 +731,17 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
          * arguments so we can avoid FIFO desync
          */
         case SVGA_CMD_RECT_ROP_FILL: /* deprecated */
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 6;
             goto badcmd;
         case SVGA_CMD_RECT_ROP_COPY: /* deprecated */
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 7;
             goto badcmd;
         case SVGA_CMD_DEFINE_ALPHA_CURSOR:
@@ -761,6 +769,10 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
             args = 12;
             goto badcmd;
         case SVGA_CMD_FENCE:
+            len -= 1;
+            if (len < 0) {
+                goto rewind;
+            }
             args = 1;
             goto badcmd;
 
-- 
1.9.1