From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47942) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z2xIe-0003tH-MG for qemu-devel@nongnu.org; Thu, 11 Jun 2015 03:53:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z2xIb-0007WI-Hn for qemu-devel@nongnu.org; Thu, 11 Jun 2015 03:53:20 -0400 From: Gerd Hoffmann Date: Thu, 11 Jun 2015 09:52:59 +0200 Message-Id: <1434009180-16351-2-git-send-email-kraxel@redhat.com> In-Reply-To: <1434009180-16351-1-git-send-email-kraxel@redhat.com> References: <1434009180-16351-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PULL 1/2] spice-display: fix segfault in qemu_spice_create_update List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , qemu-stable@nongnu.org Although it is pretty unusual the stride for the guest image and the mirror image maintained by spice-display can be different. So use separate variables for them. https://bugzilla.redhat.com/show_bug.cgi?id=1163047 Cc: qemu-stable@nongnu.org Reported-by: perrier vincent Signed-off-by: Gerd Hoffmann --- ui/spice-display.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ui/spice-display.c b/ui/spice-display.c index 9c63132..4e6356a 100644 --- a/ui/spice-display.c +++ b/ui/spice-display.c @@ -199,7 +199,7 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) static const int blksize = 32; int blocks = (surface_width(ssd->ds) + blksize - 1) / blksize; int dirty_top[blocks]; - int y, yoff, x, xoff, blk, bw; + int y, yoff1, yoff2, x, xoff, blk, bw; int bpp = surface_bytes_per_pixel(ssd->ds); uint8_t *guest, *mirror; @@ -214,13 +214,14 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) guest = surface_data(ssd->ds); mirror = (void *)pixman_image_get_data(ssd->mirror); for (y = ssd->dirty.top; y < ssd->dirty.bottom; y++) { - yoff = y * surface_stride(ssd->ds); + yoff1 = y * surface_stride(ssd->ds); + yoff2 = y * pixman_image_get_stride(ssd->mirror); for (x = ssd->dirty.left; x < ssd->dirty.right; x += blksize) { xoff = x * bpp; blk = x / blksize; bw = MIN(blksize, ssd->dirty.right - x); - if (memcmp(guest + yoff + xoff, - mirror + yoff + xoff, + if (memcmp(guest + yoff1 + xoff, + mirror + yoff2 + xoff, bw * bpp) == 0) { if (dirty_top[blk] != -1) { QXLRect update = { -- 1.8.3.1