From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:55148) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TC53T-00058r-3v for qemu-devel@nongnu.org; Thu, 13 Sep 2012 04:45:48 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TC53E-00017W-BW for qemu-devel@nongnu.org; Thu, 13 Sep 2012 04:45:46 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53869) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TC53D-00016x-T1 for qemu-devel@nongnu.org; Thu, 13 Sep 2012 04:45:32 -0400 From: Gerd Hoffmann Date: Thu, 13 Sep 2012 10:45:21 +0200 Message-Id: <1347525926-28563-6-git-send-email-kraxel@redhat.com> In-Reply-To: <1347525926-28563-1-git-send-email-kraxel@redhat.com> References: <1347525926-28563-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH 05/10] qxl: dont update invalid area List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Dunrong Huang From: Dunrong Huang This patch fixes the following error: $ ~/usr/bin/qemu-system-x86_64 -enable-kvm -m 1024 -spice port=5900,disable-ticketing -vga qxl -cdrom ~/Images/linuxmint-13-mate-dvd-32bit.iso (/home/mathslinux/usr/bin/qemu-system-x86_64:10068): SpiceWorker-CRITICAL **: red_worker.c:4599:red_update_area: condition `area->left >= 0 && area->top >= 0 && area->left < area->right && area->top < area->bottom' failed Aborted spice server terminates QEMU process if we pass invalid area to it, so dont update those invalid areas. Signed-off-by: Dunrong Huang Signed-off-by: Gerd Hoffmann --- hw/qxl.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/hw/qxl.c b/hw/qxl.c index 257a37d..0176b1a 100644 --- a/hw/qxl.c +++ b/hw/qxl.c @@ -1470,6 +1470,13 @@ async_common: return; } + if (update.left < 0 || update.top < 0 || update.left >= update.right || + update.top >= update.bottom) { + qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: " + "invalid area(%d,%d,%d,%d)\n", update.left, + update.right, update.top, update.bottom); + break; + } if (async == QXL_ASYNC) { cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO, QXL_IO_UPDATE_AREA_ASYNC); -- 1.7.1