* [Qemu-devel] [PATCH] vnc: Limit r/w access to size of allocated memory
@ 2011-03-15 18:45 Stefan Weil
0 siblings, 0 replies; only message in thread
From: Stefan Weil @ 2011-03-15 18:45 UTC (permalink / raw)
To: qemu-devel; +Cc: Anthony Liguori
This fixes memory reads and writes which exceeded the upper limit
of allocated memory vd->guest.ds->data and vd->server->data.
Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
---
ui/vnc.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index 34dc0cd..4ea8f54 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2399,6 +2399,9 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
* Update server dirty map.
*/
cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
+ if (cmp_bytes > vd->ds->surface->linesize) {
+ cmp_bytes = vd->ds->surface->linesize;
+ }
guest_row = vd->guest.ds->data;
server_row = vd->server->data;
for (y = 0; y < vd->guest.ds->height; y++) {
--
1.7.2.3
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-03-15 18:45 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-15 18:45 [Qemu-devel] [PATCH] vnc: Limit r/w access to size of allocated memory Stefan Weil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).