diff --git a/0514-qxl-vnc-register-a-vm-state-handler-for-dummy-spice_.patch b/0514-qxl-vnc-register-a-vm-state-handler-for-dummy-spice_.patch
new file mode 100644
index 0000000..89b2137
--- /dev/null
+++ b/0514-qxl-vnc-register-a-vm-state-handler-for-dummy-spice_.patch
@@ -0,0 +1,31 @@
+From 938b8a36b65e44c44ca29245437f8d7ac0f826e8 Mon Sep 17 00:00:00 2001
+From: Uri Lublin <uril@redhat.com>
+Date: Wed, 12 Dec 2012 16:30:47 +0000
+Subject: qxl+vnc: register a vm state change handler for dummy spice_server
+
+When qxl + vnc are used, a dummy spice_server is initialized.
+The spice_server has to be told when the VM runstate changes,
+which is what this patch does.
+
+Without it, from qxl_send_events(), the following error message is shown:
+  qxl_send_events: spice-server bug: guest stopped, ignoring
+
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Uri Lublin <uril@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+diff --git a/ui/spice-core.c b/ui/spice-core.c
+index 261c6f2..59ce5f6 100644
+--- a/ui/spice-core.c
++++ b/ui/spice-core.c
+@@ -732,6 +732,8 @@ int qemu_spice_add_interface(SpiceBaseInstance *sin)
+          */
+         spice_server = spice_server_new();
+         spice_server_init(spice_server, &core_interface);
++        qemu_add_vm_change_state_handler(vm_change_state_handler,
++                                         &spice_server);
+     }
+ 
+     return spice_server_add_interface(spice_server, sin);
+--
+cgit v0.9.0.2-2-gbebe
diff --git a/qemu.spec b/qemu.spec
index 386f787..fd17d5c 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -109,7 +109,7 @@
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 1.2.2
-Release: 2%{?dist}
+Release: 3%{?dist}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -467,6 +467,7 @@ Patch0510: 0510-qxl-add-trace-event-for-QXL_IO_LOG.patch
 Patch0511: 0511-hw-qxl-support-client-monitor-configuration-via-devi.patch
 Patch0512: 0512-qxl-update_area_io-cleanup-invalid-parameters-handli.patch
 Patch0513: 0513-qxl-fix-range-check-for-rev3-io-commands.patch
+Patch0514: 0514-qxl-vnc-register-a-vm-state-handler-for-dummy-spice_.patch
 
 # usb-redir live-migration and misc bits from upstream master
 Patch0601: 0601-usb-redir-Convert-to-new-libusbredirparser-0.5-API.patch
@@ -1278,6 +1279,7 @@ CAC emulation development files.
 %patch0511 -p1
 %patch0512 -p1
 %patch0513 -p1
+%patch0514 -p1
 
 # usb-redir live-migration and misc bits from upstream master
 %patch0601 -p1
@@ -1935,6 +1937,9 @@ getent passwd qemu >/dev/null || \
 %{_libdir}/pkgconfig/libcacard.pc
 
 %changelog
+* Fri Jan 18 2013 Hans de Goede <hdegoede@redhat.com> - 2:1.2.2-3
+- Fix a crash when using -vga qxl without -spice (bz #892075)
+
 * Wed Jan 16 2013 Cole Robinson <crobinso@redhat.com> - 2:1.2.2-2
 - CVE-2012-6075: Buffer overflow in e1000 nic (bz #889301, bz #889304)
 - Use systemd spec macros (bz #850285)