From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=46458 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1OOBha-0004yC-AF for qemu-devel@nongnu.org; Mon, 14 Jun 2010 11:35:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69) (envelope-from ) id 1OOBhX-0000tq-KY for qemu-devel@nongnu.org; Mon, 14 Jun 2010 11:35:52 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53301) by eggs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1OOBhX-0000tj-Dx for qemu-devel@nongnu.org; Mon, 14 Jun 2010 11:35:51 -0400 Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o5EFZoes015505 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 14 Jun 2010 11:35:50 -0400 From: Gerd Hoffmann Date: Mon, 14 Jun 2010 17:35:47 +0200 Message-Id: <1276529747-22891-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [RfC PATCH] Fix vnc memory corruption with width = 1400 List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann vnc assumes that the screen width is a multiple of 16 in several places. If this is not the case vnc will overrun buffers, corrupt memory, make qemu crash. This is the minimum fix for this bug. It makes sure we don't overrun the scanline, thereby fixing the segfault. The rendering is *not* correct though, there is a black border at the right side of the screen, 8 pixels wide because 1400 % 16 == 8. Not sure what the best way to fix that for real is. qemu allways sends updates which are 16 (or a multiple of 16) pixels wide. I'm not sure whenever this is something specified in the protocol or just in the qemu implementation. jpeg encodes 16x16 blocks too. How does vnc+jpeg-encoding handle odd screen sizes? Signed-off-by: Gerd Hoffmann --- vnc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/vnc.c b/vnc.c index 142e769..a4187a1 100644 --- a/vnc.c +++ b/vnc.c @@ -2205,7 +2205,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) guest_ptr = guest_row; server_ptr = server_row; - for (x = 0; x < vd->guest.ds->width; + for (x = 0; x + 15 < vd->guest.ds->width; x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { if (!vnc_get_bit(vd->guest.dirty[y], (x / 16))) continue; -- 1.6.5.2