From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56737) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XOjwY-0005zq-1v for qemu-devel@nongnu.org; Tue, 02 Sep 2014 05:00:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XOjwQ-0007R7-4B for qemu-devel@nongnu.org; Tue, 02 Sep 2014 05:00:01 -0400 From: Gerd Hoffmann Date: Tue, 2 Sep 2014 10:59:43 +0200 Message-Id: <1409648384-2096-2-git-send-email-kraxel@redhat.com> In-Reply-To: <1409648384-2096-1-git-send-email-kraxel@redhat.com> References: <1409648384-2096-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PULL 1/2] qxl-render: add more sanity checks List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , qemu-stable@nongnu.org Damn, the dirty rectangle values are signed integers. So the checks added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good enough, we also have to make sure they are not negative. [ Note: There must be something broken in spice-server so we get negative values in the first place. Bug opened: https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ] Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann Reviewed-by: Dr. David Alan Gilbert --- hw/display/qxl-render.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index cc2c2b1..bcc5c37 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -138,7 +138,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) if (qemu_spice_rect_is_empty(qxl->dirty+i)) { break; } - if (qxl->dirty[i].left > qxl->dirty[i].right || + if (qxl->dirty[i].left < 0 || + qxl->dirty[i].top < 0 || + qxl->dirty[i].left > qxl->dirty[i].right || qxl->dirty[i].top > qxl->dirty[i].bottom || qxl->dirty[i].right > qxl->guest_primary.surface.width || qxl->dirty[i].bottom > qxl->guest_primary.surface.height) { -- 1.8.3.1