[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 1/2] qxl-render: add more sanity checks
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 1/2] qxl-render: add more sanity checks |
Date: |
Tue, 2 Sep 2014 10:59:43 +0200 |
Damn, the dirty rectangle values are signed integers. So the checks
added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good
enough, we also have to make sure they are not negative.
[ Note: There must be something broken in spice-server so we get
negative values in the first place. Bug opened:
https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ]
Cc: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Dr. David Alan Gilbert <address@hidden>
---
hw/display/qxl-render.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
index cc2c2b1..bcc5c37 100644
--- a/hw/display/qxl-render.c
+++ b/hw/display/qxl-render.c
@@ -138,7 +138,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice
*qxl)
if (qemu_spice_rect_is_empty(qxl->dirty+i)) {
break;
}
- if (qxl->dirty[i].left > qxl->dirty[i].right ||
+ if (qxl->dirty[i].left < 0 ||
+ qxl->dirty[i].top < 0 ||
+ qxl->dirty[i].left > qxl->dirty[i].right ||
qxl->dirty[i].top > qxl->dirty[i].bottom ||
qxl->dirty[i].right > qxl->guest_primary.surface.width ||
qxl->dirty[i].bottom > qxl->guest_primary.surface.height) {
--
1.8.3.1