All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH v8 1/4] qxl/update_area_io: guest_bug on invalid parameters
@ 2012-08-20  9:32 Alon Levy
  2012-08-20  9:32 ` [Qemu-devel] [PATCH v8 2/4] qxl: disallow unknown revisions Alon Levy
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Alon Levy @ 2012-08-20  9:32 UTC (permalink / raw)
  To: qemu-devel, kraxel

Signed-off-by: Alon Levy <alevy@redhat.com>
---

Changes for patchset v7->v8:
 QXL_IO_MONITORS_CONFIG_ASYNC is defined even when spice-protocol < 0.12 (Gerd Hoffman)
 QXL_HAS_.. is either defined or not, same as other feature definitions (Blue Swirl)

 Only the third patch "qxl: add QXL_IO_MONITORS_CONFIG_ASYNC" is affected.

 hw/qxl.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/qxl.c b/hw/qxl.c
index c2dd3b4..6c48eb9 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1385,6 +1385,18 @@ async_common:
         QXLCookie *cookie = NULL;
         QXLRect update = d->ram->update_area;
 
+        if (d->ram->update_surface > NUM_SURFACES) {
+            qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
+                              d->ram->update_surface);
+            return;
+        }
+        if (update.left >= update.right || update.top >= update.bottom) {
+            qxl_set_guest_bug(d,
+                    "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
+                    update.left, update.top, update.right, update.bottom);
+            return;
+        }
+
         if (async == QXL_ASYNC) {
             cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
                                     QXL_IO_UPDATE_AREA_ASYNC);
-- 
1.7.11.2

^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2012-08-20 10:38 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-08-20  9:32 [Qemu-devel] [PATCH v8 1/4] qxl/update_area_io: guest_bug on invalid parameters Alon Levy
2012-08-20  9:32 ` [Qemu-devel] [PATCH v8 2/4] qxl: disallow unknown revisions Alon Levy
2012-08-20  9:32 ` [Qemu-devel] [PATCH v8 3/4] qxl: add QXL_IO_MONITORS_CONFIG_ASYNC Alon Levy
2012-08-20 10:38   ` Gerd Hoffmann
2012-08-20  9:32 ` [Qemu-devel] [PATCH v8 4/4] configure: print spice-protocol and spice-server versions Alon Levy

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.