[Qemu-devel] [PULL 0/1] spice patch queue

[Qemu-devel] [PULL 0/1] spice patch queue

[Gerd Hoffmann]

  Hi,

Pretty short this time, just a single bugfix.

please pull,
  Gerd

The following changes since commit 105a060188dc6fdd4551571a966514d1a5f6815a:

  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140220' into staging (2014-02-21 15:04:58 +0000)

are available in the git repository at:


  git://anongit.freedesktop.org/spice/qemu tags/pull-spice-3

for you to fetch changes up to 9c70434f825fd0d2e89d1aa0f872159378d0aab3:

  qxl: add sanity check (2014-02-24 13:00:52 +0100)

----------------------------------------------------------------
qxl: add sanity check

----------------------------------------------------------------
Gerd Hoffmann (1):
      qxl: add sanity check

 hw/display/qxl.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

[Qemu-devel] [PATCH 1/1] qxl: add sanity check

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
---
 hw/display/qxl.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 1471cc0..2a559eb 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1429,7 +1429,7 @@ static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async)
     return 1;
 }
 
-static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
+static void qxl_set_mode(PCIQXLDevice *d, unsigned int modenr, int loadvm)
 {
     pcibus_t start = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;
     pcibus_t end   = d->pci.io_regions[QXL_RAM_RANGE_INDEX].size + start;
@@ -1439,6 +1439,12 @@ static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
         .mem_start = start,
         .mem_end = end
     };
+
+    if (modenr >= d->modes->n_modes) {
+        qxl_set_guest_bug(d, "mode number out of range");
+        return;
+    }
+
     QXLSurfaceCreate surface = {
         .width      = mode->x_res,
         .height     = mode->y_res,
-- 
1.8.3.1

Re: [Qemu-devel] [PULL 0/1] spice patch queue

[Peter Maydell]

On 24 February 2014 12:05, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Pretty short this time, just a single bugfix.
>
> please pull,
>   Gerd
>
> The following changes since commit 105a060188dc6fdd4551571a966514d1a5f6815a:
>
>   Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140220' into staging (2014-02-21 15:04:58 +0000)
>
> are available in the git repository at:
>
>
>   git://anongit.freedesktop.org/spice/qemu tags/pull-spice-3
>
> for you to fetch changes up to 9c70434f825fd0d2e89d1aa0f872159378d0aab3:

Applied, thanks.

-- PMM