Re: [Qemu-devel] [PATCH 05/10] qxl: dont update invalid area

[Michael Tokarev <mjt@tls.msk.ru>]

On 13.09.2012 12:45, Gerd Hoffmann wrote:
> From: Dunrong Huang <riegamaths@gmail.com>
> 
> This patch fixes the following error:
> 
> $ ~/usr/bin/qemu-system-x86_64 -enable-kvm -m 1024 -spice port=5900,disable-ticketing -vga qxl -cdrom ~/Images/linuxmint-13-mate-dvd-32bit.iso
> (/home/mathslinux/usr/bin/qemu-system-x86_64:10068): SpiceWorker-CRITICAL **: red_worker.c:4599:red_update_area: condition `area->left >= 0 && area->top >= 0 && area->left < area->right && area->top < area->bottom' failed
> Aborted
> 
> spice server terminates QEMU process if we pass invalid area to it,
> so dont update those invalid areas.
> 
> Signed-off-by: Dunrong Huang <riegamaths@gmail.com>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
>  hw/qxl.c |    7 +++++++
>  1 files changed, 7 insertions(+), 0 deletions(-)
> 
> diff --git a/hw/qxl.c b/hw/qxl.c
> index 257a37d..0176b1a 100644
> --- a/hw/qxl.c
> +++ b/hw/qxl.c
> @@ -1470,6 +1470,13 @@ async_common:
>              return;
>          }
>  
> +        if (update.left < 0 || update.top < 0 || update.left >= update.right ||
> +            update.top >= update.bottom) {
> +            qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: "
> +                              "invalid area(%d,%d,%d,%d)\n", update.left,
> +                              update.right, update.top, update.bottom);
> +            break;
> +        }

Please take a look at the previous chunk of code, which was
added in 511b13e2c9b426b3c56060909693de5097f0b496
"qxl/update_area_io: guest_bug on invalid parameters" by alevy:

+        if (d->ram->update_surface > NUM_SURFACES) {
+            qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
+                              d->ram->update_surface);
+            return;
+        }
+        if (update.left >= update.right || update.top >= update.bottom) {
+            qxl_set_guest_bug(d,
+                    "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
+                    update.left, update.top, update.right, update.bottom);
+            return;
+        }
+

Now, this place looks.. well.. funny.

A (trivial) cleanup patch is on the way.

Thanks,

/mjt