[Qemu-devel] [PATCH] spice-display: fix segfault in qemu_spice_create_update

[Qemu-devel] [PATCH] spice-display: fix segfault in qemu_spice_create_update

[Gerd Hoffmann]

Although it is pretty unusual the stride for the guest image and the
mirror image maintained by spice-display can be different.  So use
separate variables for them.

Cc: qemu-stable@nongnu.org
Reported-by: perrier vincent <clownix@clownix.net>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 ui/spice-display.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/ui/spice-display.c b/ui/spice-display.c
index 9c63132..4e6356a 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -199,7 +199,7 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
     static const int blksize = 32;
     int blocks = (surface_width(ssd->ds) + blksize - 1) / blksize;
     int dirty_top[blocks];
-    int y, yoff, x, xoff, blk, bw;
+    int y, yoff1, yoff2, x, xoff, blk, bw;
     int bpp = surface_bytes_per_pixel(ssd->ds);
     uint8_t *guest, *mirror;
 
@@ -214,13 +214,14 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
     guest = surface_data(ssd->ds);
     mirror = (void *)pixman_image_get_data(ssd->mirror);
     for (y = ssd->dirty.top; y < ssd->dirty.bottom; y++) {
-        yoff = y * surface_stride(ssd->ds);
+        yoff1 = y * surface_stride(ssd->ds);
+        yoff2 = y * pixman_image_get_stride(ssd->mirror);
         for (x = ssd->dirty.left; x < ssd->dirty.right; x += blksize) {
             xoff = x * bpp;
             blk = x / blksize;
             bw = MIN(blksize, ssd->dirty.right - x);
-            if (memcmp(guest + yoff + xoff,
-                       mirror + yoff + xoff,
+            if (memcmp(guest + yoff1 + xoff,
+                       mirror + yoff2 + xoff,
                        bw * bpp) == 0) {
                 if (dirty_top[blk] != -1) {
                     QXLRect update = {
-- 
1.8.3.1

Re: [Qemu-devel] [Qemu-stable] [PATCH] spice-display: fix segfault in qemu_spice_create_update

[Cole Robinson]

On 06/10/2015 05:24 AM, Gerd Hoffmann wrote:
> Although it is pretty unusual the stride for the guest image and the
> mirror image maintained by spice-display can be different.  So use
> separate variables for them.
> 
> Cc: qemu-stable@nongnu.org
> Reported-by: perrier vincent <clownix@clownix.net>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Cool, hopefully this fixes:

https://bugzilla.redhat.com/show_bug.cgi?id=1163047

There's over 50 faf hits for it:

https://retrace.fedoraproject.org/faf/reports/bthash/0d3245e479f9d9a3b908c34214599f7e45bb2d69

- Cole