From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=33582 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PuAkC-0004go-Ku for qemu-devel@nongnu.org; Mon, 28 Feb 2011 16:35:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PuAkB-0006cz-Cg for qemu-devel@nongnu.org; Mon, 28 Feb 2011 16:35:04 -0500 Received: from moutng.kundenserver.de ([212.227.17.8]:53415) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PuAkB-0006ax-1U for qemu-devel@nongnu.org; Mon, 28 Feb 2011 16:35:03 -0500 From: Stefan Weil Date: Mon, 28 Feb 2011 22:34:52 +0100 Message-Id: <1298928892-24039-1-git-send-email-weil@mail.berlios.de> Subject: [Qemu-devel] [PATCH] vnc: Fix heap corruption List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Corentin Chary , Anthony Liguori Commit bc2429b9174ac2d3c56b7fd35884b0d89ec7fb02 introduced a severe bug (heap corruption). bitmap_clear was called with a wrong argument which caused out-of-bound writes to width_mask. This bug was detected with QEMU running on windows. It also occurs with wine: *** stack smashing detected ***: terminated wine: Unhandled illegal instruction at address 0x6115c7 (thread 0009), starting debugger... The bug is not windows specific! Cc: Corentin Chary Cc: Anthony Liguori Signed-off-by: Stefan Weil --- ui/vnc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index af55156..89f71da 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2401,7 +2401,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) */ bitmap_set(width_mask, 0, (ds_get_width(vd->ds) / 16)); bitmap_clear(width_mask, (ds_get_width(vd->ds) / 16), - VNC_DIRTY_WORDS * BITS_PER_LONG); + (VNC_MAX_WIDTH - ds_get_width(vd->ds)) / 16); cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds); guest_row = vd->guest.ds->data; server_row = vd->server->data; -- 1.7.2.3