From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=53081 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PudEA-0000eX-OO for qemu-devel@nongnu.org; Tue, 01 Mar 2011 22:59:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PudE9-0003kS-B2 for qemu-devel@nongnu.org; Tue, 01 Mar 2011 22:59:54 -0500 Received: from [222.73.24.84] (port=65061 helo=song.cn.fujitsu.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PudE9-0003kF-0U for qemu-devel@nongnu.org; Tue, 01 Mar 2011 22:59:53 -0500 Message-ID: <4D6DC06B.6070308@cn.fujitsu.com> Date: Wed, 02 Mar 2011 11:58:35 +0800 From: Wen Congyang MIME-Version: 1.0 References: <4D6DBDA4.3050909@cn.fujitsu.com> In-Reply-To: <4D6DBDA4.3050909@cn.fujitsu.com> Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=ISO-8859-1 Subject: [Qemu-devel] [PATCH RESEND 2/2] vnc: Fix heap corruption List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel , Stefan Weil , Anthony Liguori , Corentin Chary This bug is reported by Stefan Weil: ======== Commit bc2429b9174ac2d3c56b7fd35884b0d89ec7fb02 introduced a severe bug (heap corruption). bitmap_clear was called with a wrong argument which caused out-of-bound writes to width_mask. This bug was detected with QEMU running on windows. It also occurs with wine: *** stack smashing detected ***: terminated wine: Unhandled illegal instruction at address 0x6115c7 (thread 0009), starting debugger... The bug is not windows specific! ======== The third argument of bitmap_clear() is number of bits to be cleared, but we pass the end bits to be cleared to bitmap_clear(). Signed-off-by: Wen Congyang Reported-by: Stefan Weil --- ui/vnc.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index e3761b0..e7d0b5b 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2390,6 +2390,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) unsigned long width_mask[VNC_DIRTY_WORDS]; VncState *vs; int has_dirty = 0; + const size_t width = ds_get_width(vd->ds) / 16; struct timeval tv = { 0, 0 }; @@ -2403,9 +2404,8 @@ static int vnc_refresh_server_surface(VncDisplay *vd) * Check and copy modified bits from guest to server surface. * Update server dirty map. */ - bitmap_set(width_mask, 0, (ds_get_width(vd->ds) / 16)); - bitmap_clear(width_mask, (ds_get_width(vd->ds) / 16), - VNC_DIRTY_WORDS * BITS_PER_LONG); + bitmap_set(width_mask, 0, width); + bitmap_clear(width_mask, width, VNC_DIRTY_WORDS * BITS_PER_LONG - width); cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds); guest_row = vd->guest.ds->data; server_row = vd->server->data; -- 1.7.1