From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:34032) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4dfh-0005SJ-M7 for qemu-devel@nongnu.org; Mon, 05 Mar 2012 14:34:22 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1S4dfW-0005JP-ML for qemu-devel@nongnu.org; Mon, 05 Mar 2012 14:34:08 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:32787) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4dfW-0005CB-GM for qemu-devel@nongnu.org; Mon, 05 Mar 2012 14:34:02 -0500 Date: Mon, 5 Mar 2012 13:33:47 -0600 From: Serge Hallyn Message-ID: <20120305193347.GA31914@peqn> References: <20120302211122.GA9652@vostro.hallyn.com> <20120302212030.GP21784@us.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20120302212030.GP21784@us.ibm.com> Subject: [Qemu-devel] [PATCH 1/1] vmware_vga: stop crashing List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Ryan Harper Cc: qemu-devel@nongnu.org if x or y < 0, set them to 0 (and decrement width/height accordingly)> I don't know where the best place to catch this would be, but with vnc and vmware_vga it's possible to get set_bit called on a negative index, crashing qemu. See https://bugs.launchpad.net/ubuntu/+source/qemu-kvm/+bug/918791 for details. This patch prevents that. It's possible this should be caught earlier, but this patch works for me. Changelog: Mar 5: As Ryan Harper pointed out, don't mix tabs+spaces, and put {} around all conditionals. Signed-off-by: Serge Hallyn --- hw/vmware_vga.c | 18 ++++++++++++++++++ 1 files changed, 18 insertions(+), 0 deletions(-) diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c index 142d9f4..c94f9f3 100644 --- a/hw/vmware_vga.c +++ b/hw/vmware_vga.c @@ -298,6 +298,24 @@ static inline void vmsvga_update_rect(struct vmsvga_state_s *s, uint8_t *src; uint8_t *dst; + if (x < 0) { + fprintf(stderr, "%s: update x was < 0 (%d, w %d)\n", + __FUNCTION__, x, w); + w += x; + if (w < 0) { + return; + } + x = 0; + } + if (y < 0) { + fprintf(stderr, "%s: update y was < 0 (%d, h %d)\n", + __FUNCTION__, y, h); + h += y; + if (h < 0) { + return; + } + y = 0; + } if (x + w > s->width) { fprintf(stderr, "%s: update width too large x: %d, w: %d\n", __FUNCTION__, x, w); -- 1.7.9