From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=56440 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1Q8o8r-0007CY-67
	for qemu-devel@nongnu.org; Sun, 10 Apr 2011 02:29:01 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <weil@mail.berlios.de>) id 1Q8o8q-00020k-2H
	for qemu-devel@nongnu.org; Sun, 10 Apr 2011 02:29:01 -0400
Received: from moutng.kundenserver.de ([212.227.17.10]:51434)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <weil@mail.berlios.de>) id 1Q8o8p-00020T-NP
	for qemu-devel@nongnu.org; Sun, 10 Apr 2011 02:29:00 -0400
Message-ID: <4DA14DF2.1040900@mail.berlios.de>
Date: Sun, 10 Apr 2011 08:28:02 +0200
From: Stefan Weil <weil@mail.berlios.de>
MIME-Version: 1.0
Subject: Re: [Qemu-devel] [PATCH 4/4] vnc: Limit r/w access to size
	of	allocated memory
References: <1300696478-6051-1-git-send-email-corentin.chary@gmail.com>	<1300696478-6051-5-git-send-email-corentin.chary@gmail.com>
	<20110409221739.GB11487@volta.aurel32.net>
In-Reply-To: <20110409221739.GB11487@volta.aurel32.net>
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Aurelien Jarno <aurelien@aurel32.net>
Cc: Blue Swirl <blauwirbel@gmail.com>, Paolo Bonzini <pbonzini@redhat.com>, Anthony Liguori <aliguori@us.ibm.com>, qemu-devel <qemu-devel@nongnu.org>, Corentin Chary <corentin.chary@gmail.com>

Am 10.04.2011 00:17, schrieb Aurelien Jarno:
> On Mon, Mar 21, 2011 at 09:34:38AM +0100, Corentin Chary wrote:
>> From: Stefan Weil <weil@mail.berlios.de>
>>
>> This fixes memory reads and writes which exceeded the upper limit
>> of allocated memory vd->guest.ds->data and vd->server->data.
>>
>> Cc: Anthony Liguori <aliguori@us.ibm.com>
>> Signed-off-by: Stefan Weil <weil@mail.berlios.de>
>> Signed-off-by: Corentin Chary <corentin.chary@gmail.com>
>> ---
>> ui/vnc.c | 3 +++
>> 1 files changed, 3 insertions(+), 0 deletions(-)
>>
>> diff --git a/ui/vnc.c b/ui/vnc.c
>> index 90b6384..3138053 100644
>> --- a/ui/vnc.c
>> +++ b/ui/vnc.c
>> @@ -2414,6 +2414,9 @@ static int 
>> vnc_refresh_server_surface(VncDisplay *vd)
>> * Update server dirty map.
>> */
>> cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
>> + if (cmp_bytes > vd->ds->surface->linesize) {
>> + cmp_bytes = vd->ds->surface->linesize;
>> + }
>
> What about using ds_get_linesize(vd->ds) instead?

Yes, that's better. Please either change the two lines, or
wait until I have sent a new version of the patch.

The patch should be applied to stable, too.

Thanks,
Stefan