[Qemu-devel] [RFC] fix crashes with vmware driver

[Serge Hallyn]

Hi,

I don't know where the best place to catch this would be, but
with vnc and vmware_vga it's possible to get set_bit called on
a negative index, crashing qemu.  See

https://bugs.launchpad.net/ubuntu/+source/qemu-kvm/+bug/918791

for details.  This patch prevents that.  It's possible this
should be caught earlier, but this patch works for me.

Signed-off-by: Serge Hallyn <address@hidden>
---
 vmware_vga.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

Index: qemu-kvm-1.0+noroms/hw/vmware_vga.c
===================================================================
--- qemu-kvm-1.0+noroms.orig/hw/vmware_vga.c    2012-03-01 16:19:23.280571798 
-0600
+++ qemu-kvm-1.0+noroms/hw/vmware_vga.c 2012-03-01 16:27:27.910975006 -0600
@@ -298,6 +298,22 @@
     uint8_t *src;
     uint8_t *dst;
 
+    if (x < 0) {
+        fprintf(stderr, "%s: update x was < 0 (%d, w %d)\n",
+                        __FUNCTION__, x, w);
+        w += x;
+       if (w < 0)
+               return;
+        x = 0;
+    }
+    if (y < 0) {
+        fprintf(stderr, "%s: update y was < 0 (%d, h %d)\n",
+                        __FUNCTION__, y, h);
+        h += y;
+       if (h < 0)
+               return;
+        y = 0;
+    }
     if (x + w > s->width) {
         fprintf(stderr, "%s: update width too large x: %d, w: %d\n",
                         __FUNCTION__, x, w);