From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gerd Hoffmann Subject: Re: building vgabios-stdvga.bin Date: Tue, 20 Dec 2011 16:37:03 +0100 Message-ID: <4EF0AB9F.5040403@redhat.com> References: <201112201500.pBKF0mDY005298@hope.more-right-rudder.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------050807030004050409060401" Cc: kvm@vger.kernel.org To: Rick Koshi Return-path: Received: from mx1.redhat.com ([209.132.183.28]:50919 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751414Ab1LTPhH (ORCPT ); Tue, 20 Dec 2011 10:37:07 -0500 In-Reply-To: <201112201500.pBKF0mDY005298@hope.more-right-rudder.com> Sender: kvm-owner@vger.kernel.org List-ID: This is a multi-part message in MIME format. --------------050807030004050409060401 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Hi, > I don't know if this is the right place to make this suggestion, > but it would be nice if this version could make it into the > qemu-kvm distribution. > Do you know what the real constraints are? Do you know if they're > imposed by the vgabios driver, the VNC module, or the guest > operating system (Windows 7 in this case)? vnc works with 16x16 internally, so a multiple of 16 should be fine. Reminds me of a bug, I've trapped into this before, digging ... Patch attached. Seems to be still not applied, has been on the qemu-devel list several times already :-( HTH, Gerd --------------050807030004050409060401 Content-Type: text/plain; name="vnc.diff" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="vnc.diff" commit a22fe41d90d484a68317e0ac46785611afab545f Author: Gerd Hoffmann Date: Mon Jun 14 12:28:23 2010 +0200 Fix vnc memory corruption with width = 1400 vnc assumes that the screen width is a multiple of 16 in several places. If this is not the case vnc will overrun buffers, corrupt memory, make qemu crash. This is the minimum fix for this bug. It makes sure we don't overrun the scanline, thereby fixing the segfault. The rendering is *not* correct though, there is a black border at the right side of the screen, 8 pixels wide because 1400 % 16 == 8. Signed-off-by: Gerd Hoffmann diff --git a/ui/vnc.c b/ui/vnc.c index e85ee66..afbf82c 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2445,7 +2445,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) guest_ptr = guest_row; server_ptr = server_row; - for (x = 0; x < vd->guest.ds->width; + for (x = 0; x + 15 < vd->guest.ds->width; x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { if (!test_and_clear_bit((x / 16), vd->guest.dirty[y])) continue; --------------050807030004050409060401--