All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH v10 1/4] qxl/update_area_io: guest_bug on invalid parameters
@ 2012-08-21 10:16 Alon Levy
  2012-08-21 10:16 ` [Qemu-devel] [PATCH v10 2/4] qxl: disallow unknown revisions Alon Levy
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Alon Levy @ 2012-08-21 10:16 UTC (permalink / raw)
  To: qemu-devel, kraxel, blauwirbel

Signed-off-by: Alon Levy <alevy@redhat.com>
---
v9->v10
 Use CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC instead of -D directly, define is created in config-host.h
 so hw/qxl.[ch] is unchanged except for s/QXL_HAS_IO_MONITORS_CONFIG_ASYNC/CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC
 (Blue Swirl)
 No other patches changed. Dropped the wrongly sent last patch.

 hw/qxl.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/qxl.c b/hw/qxl.c
index c2dd3b4..6c48eb9 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1385,6 +1385,18 @@ async_common:
         QXLCookie *cookie = NULL;
         QXLRect update = d->ram->update_area;
 
+        if (d->ram->update_surface > NUM_SURFACES) {
+            qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
+                              d->ram->update_surface);
+            return;
+        }
+        if (update.left >= update.right || update.top >= update.bottom) {
+            qxl_set_guest_bug(d,
+                    "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
+                    update.left, update.top, update.right, update.bottom);
+            return;
+        }
+
         if (async == QXL_ASYNC) {
             cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
                                     QXL_IO_UPDATE_AREA_ASYNC);
-- 
1.7.11.2

^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2012-08-21 10:34 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-08-21 10:16 [Qemu-devel] [PATCH v10 1/4] qxl/update_area_io: guest_bug on invalid parameters Alon Levy
2012-08-21 10:16 ` [Qemu-devel] [PATCH v10 2/4] qxl: disallow unknown revisions Alon Levy
2012-08-21 10:16 ` [Qemu-devel] [PATCH v10 3/4] qxl: add QXL_IO_MONITORS_CONFIG_ASYNC Alon Levy
2012-08-21 10:34   ` Gerd Hoffmann
2012-08-21 10:16 ` [Qemu-devel] [PATCH v10 4/4] configure: print spice-protocol and spice-server versions Alon Levy

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.