* [Qemu-devel] segfault in memcmp
@ 2015-06-05 22:19 perrier vincent
2015-06-08 9:31 ` Stefan Hajnoczi
0 siblings, 1 reply; 3+ messages in thread
From: perrier vincent @ 2015-06-05 22:19 UTC (permalink / raw)
To: qemu-devel
Using a very old guest (lenny) with spice and vga=cirrus, I have
a segfault:
FILE: ui/spice-display.c
FUNCTION: qemu_spice_create_update
LINE: if (memcmp(guest + yoff + xoff,
mirror + yoff + xoff,
bw * bpp) == 0)
The address of mirror + yoff + xoff is out of boundaries.
I use the following to avoid the crash:
...
img_get_stride = pixman_image_get_stride(ssd->mirror);
img_height = pixman_image_get_height(ssd->mirror);
img_max = img_height * img_get_stride;
...
if (yoff > img_max)
{
if (dirty_top[blk] == -1)
dirty_top[blk] = y;
}
else if (memcmp(guest + yoff + xoff,
mirror + yoff + xoff,
bw * bpp) == 0)
{
...
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] segfault in memcmp
2015-06-05 22:19 [Qemu-devel] segfault in memcmp perrier vincent
@ 2015-06-08 9:31 ` Stefan Hajnoczi
2015-06-08 11:36 ` Gerd Hoffmann
0 siblings, 1 reply; 3+ messages in thread
From: Stefan Hajnoczi @ 2015-06-08 9:31 UTC (permalink / raw)
To: perrier vincent; +Cc: qemu-devel, Gerd Hoffmann
[-- Attachment #1: Type: text/plain, Size: 986 bytes --]
On Fri, Jun 05, 2015 at 05:19:53PM -0500, perrier vincent wrote:
> Using a very old guest (lenny) with spice and vga=cirrus, I have
> a segfault:
>
> FILE: ui/spice-display.c
> FUNCTION: qemu_spice_create_update
> LINE: if (memcmp(guest + yoff + xoff,
> mirror + yoff + xoff,
> bw * bpp) == 0)
>
> The address of mirror + yoff + xoff is out of boundaries.
>
> I use the following to avoid the crash:
>
> ...
> img_get_stride = pixman_image_get_stride(ssd->mirror);
> img_height = pixman_image_get_height(ssd->mirror);
> img_max = img_height * img_get_stride;
> ...
> if (yoff > img_max)
> {
> if (dirty_top[blk] == -1)
> dirty_top[blk] = y;
> }
> else if (memcmp(guest + yoff + xoff,
> mirror + yoff + xoff,
> bw * bpp) == 0)
> {
> ...
Thanks for the report. I have CCed Gerd Hoffmann who maintains the
graphics subsystem.
[-- Attachment #2: Type: application/pgp-signature, Size: 473 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] segfault in memcmp
2015-06-08 9:31 ` Stefan Hajnoczi
@ 2015-06-08 11:36 ` Gerd Hoffmann
0 siblings, 0 replies; 3+ messages in thread
From: Gerd Hoffmann @ 2015-06-08 11:36 UTC (permalink / raw)
To: Stefan Hajnoczi; +Cc: perrier vincent, qemu-devel
On Mo, 2015-06-08 at 10:31 +0100, Stefan Hajnoczi wrote:
> On Fri, Jun 05, 2015 at 05:19:53PM -0500, perrier vincent wrote:
> > Using a very old guest (lenny) with spice and vga=cirrus, I have
> > a segfault:
Hmm, doesn't reproduce on master (booting i386 lenny install iso).
Which qemu version is this?
> > FILE: ui/spice-display.c
> > FUNCTION: qemu_spice_create_update
> > LINE: if (memcmp(guest + yoff + xoff,
> > mirror + yoff + xoff,
> > bw * bpp) == 0)
> >
> > The address of mirror + yoff + xoff is out of boundaries.
> >
> > I use the following to avoid the crash:
> >
> > ...
> > img_get_stride = pixman_image_get_stride(ssd->mirror);
> > img_height = pixman_image_get_height(ssd->mirror);
> > img_max = img_height * img_get_stride;
> > ...
> > if (yoff > img_max)
> > {
> > if (dirty_top[blk] == -1)
> > dirty_top[blk] = y;
> > }
I'm wondering how you end up with yoff being ouf of boundaries in the
first place ...
cheers,
Gerd
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-06-08 11:36 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-06-05 22:19 [Qemu-devel] segfault in memcmp perrier vincent
2015-06-08 9:31 ` Stefan Hajnoczi
2015-06-08 11:36 ` Gerd Hoffmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).