All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH v11 1/4] qxl/update_area_io: guest_bug on invalid parameters
@ 2012-08-21 10:51 Alon Levy
  2012-08-21 10:51 ` [Qemu-devel] [PATCH v11 2/4] qxl: disallow unknown revisions Alon Levy
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Alon Levy @ 2012-08-21 10:51 UTC (permalink / raw)
  To: qemu-devel, kraxel

Signed-off-by: Alon Levy <alevy@redhat.com>
---
v10->v11
 fixed coding style: space before square bracket. fixed an old instance too. (Gerd)

 hw/qxl.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/qxl.c b/hw/qxl.c
index c2dd3b4..6c48eb9 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1385,6 +1385,18 @@ async_common:
         QXLCookie *cookie = NULL;
         QXLRect update = d->ram->update_area;
 
+        if (d->ram->update_surface > NUM_SURFACES) {
+            qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
+                              d->ram->update_surface);
+            return;
+        }
+        if (update.left >= update.right || update.top >= update.bottom) {
+            qxl_set_guest_bug(d,
+                    "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
+                    update.left, update.top, update.right, update.bottom);
+            return;
+        }
+
         if (async == QXL_ASYNC) {
             cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
                                     QXL_IO_UPDATE_AREA_ASYNC);
-- 
1.7.11.2

^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2012-08-21 12:43 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-08-21 10:51 [Qemu-devel] [PATCH v11 1/4] qxl/update_area_io: guest_bug on invalid parameters Alon Levy
2012-08-21 10:51 ` [Qemu-devel] [PATCH v11 2/4] qxl: disallow unknown revisions Alon Levy
2012-08-21 10:51 ` [Qemu-devel] [PATCH v11 3/4] qxl: add QXL_IO_MONITORS_CONFIG_ASYNC Alon Levy
2012-08-21 11:06   ` Gerd Hoffmann
2012-08-21 12:43     ` Gerd Hoffmann
2012-08-21 10:51 ` [Qemu-devel] [PATCH v11 4/4] configure: print spice-protocol and spice-server versions Alon Levy

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.