From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:39110) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S3ZlE-00016p-Pp for qemu-devel@nongnu.org; Fri, 02 Mar 2012 16:11:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1S3ZlC-0000gT-NA for qemu-devel@nongnu.org; Fri, 02 Mar 2012 16:11:32 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:52448) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S3ZlC-0000g6-HB for qemu-devel@nongnu.org; Fri, 02 Mar 2012 16:11:30 -0500 Received: from cpe-70-123-137-7.austin.res.rr.com ([70.123.137.7] helo=vostro.hallyn.com) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1S3ZlA-0004eq-3y for qemu-devel@nongnu.org; Fri, 02 Mar 2012 21:11:28 +0000 Date: Fri, 2 Mar 2012 15:11:22 -0600 From: Serge Hallyn Message-ID: <20120302211122.GA9652@vostro.hallyn.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] [RFC] fix crashes with vmware driver List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Hi, I don't know where the best place to catch this would be, but with vnc and vmware_vga it's possible to get set_bit called on a negative index, crashing qemu. See https://bugs.launchpad.net/ubuntu/+source/qemu-kvm/+bug/918791 for details. This patch prevents that. It's possible this should be caught earlier, but this patch works for me. Signed-off-by: Serge Hallyn --- vmware_vga.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) Index: qemu-kvm-1.0+noroms/hw/vmware_vga.c =================================================================== --- qemu-kvm-1.0+noroms.orig/hw/vmware_vga.c 2012-03-01 16:19:23.280571798 -0600 +++ qemu-kvm-1.0+noroms/hw/vmware_vga.c 2012-03-01 16:27:27.910975006 -0600 @@ -298,6 +298,22 @@ uint8_t *src; uint8_t *dst; + if (x < 0) { + fprintf(stderr, "%s: update x was < 0 (%d, w %d)\n", + __FUNCTION__, x, w); + w += x; + if (w < 0) + return; + x = 0; + } + if (y < 0) { + fprintf(stderr, "%s: update y was < 0 (%d, h %d)\n", + __FUNCTION__, y, h); + h += y; + if (h < 0) + return; + y = 0; + } if (x + w > s->width) { fprintf(stderr, "%s: update width too large x: %d, w: %d\n", __FUNCTION__, x, w);