From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=43404 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PhTZ0-0004wT-MR for qemu-devel@nongnu.org; Mon, 24 Jan 2011 16:03:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PhTYy-0005rc-L0 for qemu-devel@nongnu.org; Mon, 24 Jan 2011 16:03:02 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58485) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PhTYy-0005rP-Bt for qemu-devel@nongnu.org; Mon, 24 Jan 2011 16:03:00 -0500 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id p0OL2xHs025380 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 24 Jan 2011 16:02:59 -0500 From: Gerd Hoffmann Date: Mon, 24 Jan 2011 22:02:57 +0100 Message-Id: <1295902977-5490-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH] Fix vnc memory corruption with width = 1400 List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann [ note: found while cleaning up my git branches, must be quite old, rebase worked fine, looks like this one never made it upstream, resubmitting now ... ] vnc assumes that the screen width is a multiple of 16 in several places. If this is not the case vnc will overrun buffers, corrupt memory, make qemu crash. This is the minimum fix for this bug. It makes sure we don't overrun the scanline, thereby fixing the segfault. The rendering is *not* correct though, there is a black border at the right side of the screen, 8 pixels wide because 1400 % 16 == 8. Signed-off-by: Gerd Hoffmann --- ui/vnc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 495d6d6..592be8e 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2284,7 +2284,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) guest_ptr = guest_row; server_ptr = server_row; - for (x = 0; x < vd->guest.ds->width; + for (x = 0; x + 15 < vd->guest.ds->width; x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { if (!vnc_get_bit(vd->guest.dirty[y], (x / 16))) continue; -- 1.7.1