[Qemu-devel] Re: [PATCH to consider for 0.12] vmware_vga: Don't crash on too-big DEFINE_CURSOR command

[Roland Dreier]

 > His last patch has the same fix without the printf().  The printf is
 > probably something to avoid since a malicious guest could create a
 > storm of them.  Since libvirt logs stderr by default, the result could
 > be pretty nasty.

By the way, are the

        fprintf(stderr, "%s: update width too large x: %d, w: %d\n",
                        __FUNCTION__, x, w);

        fprintf(stderr, "%s: update height too large y: %d, h: %d\n",
                        __FUNCTION__, y, h);

prints triggerable by a guest?  (I think so -- if so I can send a patch
removing them if you want)

How about the printf()s to stdout?  eg a guest can cause a flood of the

            printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",
                            __FUNCTION__, cmd);

or

            printf("%s: guest runs %s.\n", __FUNCTION__,
                            vmsvga_guest_id[value - GUEST_OS_BASE]);

output if it wants pretty trivially.