From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54056) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WHuHt-00024l-PJ for qemu-devel@nongnu.org; Mon, 24 Feb 2014 07:05:39 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WHuHn-0005sx-Q3 for qemu-devel@nongnu.org; Mon, 24 Feb 2014 07:05:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:44175) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WHuHn-0005sk-Hw for qemu-devel@nongnu.org; Mon, 24 Feb 2014 07:05:27 -0500 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s1OC5Q8B029604 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 24 Feb 2014 07:05:26 -0500 From: Gerd Hoffmann Date: Mon, 24 Feb 2014 13:05:22 +0100 Message-Id: <1393243522-29038-2-git-send-email-kraxel@redhat.com> In-Reply-To: <1393243522-29038-1-git-send-email-kraxel@redhat.com> References: <1393243522-29038-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH 1/1] qxl: add sanity check List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann Signed-off-by: Gerd Hoffmann Reviewed-by: Laszlo Ersek --- hw/display/qxl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 1471cc0..2a559eb 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1429,7 +1429,7 @@ static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async) return 1; } -static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm) +static void qxl_set_mode(PCIQXLDevice *d, unsigned int modenr, int loadvm) { pcibus_t start = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr; pcibus_t end = d->pci.io_regions[QXL_RAM_RANGE_INDEX].size + start; @@ -1439,6 +1439,12 @@ static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm) .mem_start = start, .mem_end = end }; + + if (modenr >= d->modes->n_modes) { + qxl_set_guest_bug(d, "mode number out of range"); + return; + } + QXLSurfaceCreate surface = { .width = mode->x_res, .height = mode->y_res, -- 1.8.3.1