From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48719) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XNIlR-0000rs-50 for qemu-devel@nongnu.org; Fri, 29 Aug 2014 05:46:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XNIlL-0002Y2-0j for qemu-devel@nongnu.org; Fri, 29 Aug 2014 05:46:37 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55264) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XNIlK-0002Xt-PB for qemu-devel@nongnu.org; Fri, 29 Aug 2014 05:46:30 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s7T9kTYb021706 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Fri, 29 Aug 2014 05:46:29 -0400 Date: Fri, 29 Aug 2014 10:46:25 +0100 From: "Dr. David Alan Gilbert" Message-ID: <20140829094625.GE2398@work-vm> References: <1409299007-19461-1-git-send-email-kraxel@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1409299007-19461-1-git-send-email-kraxel@redhat.com> Subject: Re: [Qemu-devel] [PATCH v2] qxl-render: add more sanity checks List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann Cc: qemu-devel@nongnu.org * Gerd Hoffmann (kraxel@redhat.com) wrote: > Damn, the dirty rectangle values are signed integers. So the checks > added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good > enouth, we also have to make sure they are not negative. > > [ Note: There must be something broken in spice-server so we get > negative values in the first place. Bug opened: > https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ] > > Signed-off-by: Gerd Hoffmann > --- > hw/display/qxl-render.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c > index cc2c2b1..bcc5c37 100644 > --- a/hw/display/qxl-render.c > +++ b/hw/display/qxl-render.c > @@ -138,7 +138,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) > if (qemu_spice_rect_is_empty(qxl->dirty+i)) { > break; > } > - if (qxl->dirty[i].left > qxl->dirty[i].right || > + if (qxl->dirty[i].left < 0 || > + qxl->dirty[i].top < 0 || > + qxl->dirty[i].left > qxl->dirty[i].right || > qxl->dirty[i].top > qxl->dirty[i].bottom || > qxl->dirty[i].right > qxl->guest_primary.surface.width || > qxl->dirty[i].bottom > qxl->guest_primary.surface.height) { Reviewed-by: Dr. David Alan Gilbert Should this go for stable as well? (I was worried for a sec about what happens if right=width or bottom=height; but looking at the code below it I think it's a dirty from left..(right-1) so we're OK?) Dave > -- > 1.8.3.1 > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK