From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34656) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XNHDe-0008BY-0p for qemu-devel@nongnu.org; Fri, 29 Aug 2014 04:07:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XNHDX-0006e8-TH for qemu-devel@nongnu.org; Fri, 29 Aug 2014 04:07:37 -0400 Received: from mx1.redhat.com ([209.132.183.28]:6665) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XNHDX-0006dd-Lt for qemu-devel@nongnu.org; Fri, 29 Aug 2014 04:07:31 -0400 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s7T87VX7022111 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Fri, 29 Aug 2014 04:07:31 -0400 From: Gerd Hoffmann Date: Fri, 29 Aug 2014 09:56:47 +0200 Message-Id: <1409299007-19461-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH v2] qxl-render: add more sanity checks List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann Damn, the dirty rectangle values are signed integers. So the checks added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good enouth, we also have to make sure they are not negative. [ Note: There must be something broken in spice-server so we get negative values in the first place. Bug opened: https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ] Signed-off-by: Gerd Hoffmann --- hw/display/qxl-render.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index cc2c2b1..bcc5c37 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -138,7 +138,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) if (qemu_spice_rect_is_empty(qxl->dirty+i)) { break; } - if (qxl->dirty[i].left > qxl->dirty[i].right || + if (qxl->dirty[i].left < 0 || + qxl->dirty[i].top < 0 || + qxl->dirty[i].left > qxl->dirty[i].right || qxl->dirty[i].top > qxl->dirty[i].bottom || qxl->dirty[i].right > qxl->guest_primary.surface.width || qxl->dirty[i].bottom > qxl->guest_primary.surface.height) { -- 1.8.3.1