commit a22fe41d90d484a68317e0ac46785611afab545f
Author: Gerd Hoffmann <kraxel@redhat.com>
Date:   Mon Jun 14 12:28:23 2010 +0200

    Fix vnc memory corruption with width = 1400
    
    vnc assumes that the screen width is a multiple of 16 in several places.
    If this is not the case vnc will overrun buffers, corrupt memory, make
    qemu crash.
    
    This is the minimum fix for this bug. It makes sure we don't overrun the
    scanline, thereby fixing the segfault.  The rendering is *not* correct
    though, there is a black border at the right side of the screen, 8
    pixels wide because 1400 % 16 == 8.
    
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

diff --git a/ui/vnc.c b/ui/vnc.c
index e85ee66..afbf82c 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2445,7 +2445,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
             guest_ptr  = guest_row;
             server_ptr = server_row;
 
-            for (x = 0; x < vd->guest.ds->width;
+            for (x = 0; x + 15 < vd->guest.ds->width;
                     x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
                 if (!test_and_clear_bit((x / 16), vd->guest.dirty[y]))
                     continue;