From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51211) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WG4aU-0004R8-Qe for qemu-devel@nongnu.org; Wed, 19 Feb 2014 05:41:16 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WG4aO-0000qk-RF for qemu-devel@nongnu.org; Wed, 19 Feb 2014 05:41:10 -0500 Received: from mx1.redhat.com ([209.132.183.28]:54948) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WG4aO-0000qW-JG for qemu-devel@nongnu.org; Wed, 19 Feb 2014 05:41:04 -0500 From: Gerd Hoffmann Date: Wed, 19 Feb 2014 11:40:50 +0100 Message-Id: <1392806450-3452-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH] qxl: add sanity check List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: spice-devel@lists.freedesktop.org, Gerd Hoffmann Signed-off-by: Gerd Hoffmann --- hw/display/qxl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 1471cc0..2a559eb 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1429,7 +1429,7 @@ static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async) return 1; } -static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm) +static void qxl_set_mode(PCIQXLDevice *d, unsigned int modenr, int loadvm) { pcibus_t start = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr; pcibus_t end = d->pci.io_regions[QXL_RAM_RANGE_INDEX].size + start; @@ -1439,6 +1439,12 @@ static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm) .mem_start = start, .mem_end = end }; + + if (modenr >= d->modes->n_modes) { + qxl_set_guest_bug(d, "mode number out of range"); + return; + } + QXLSurfaceCreate surface = { .width = mode->x_res, .height = mode->y_res, -- 1.8.3.1