From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=52348 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1Puuiw-0004Z5-U6
	for qemu-devel@nongnu.org; Wed, 02 Mar 2011 17:40:56 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1Puuio-0005yO-PU
	for qemu-devel@nongnu.org; Wed, 02 Mar 2011 17:40:43 -0500
Received: from mail-ey0-f173.google.com ([209.85.215.173]:61856)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1Puuio-0005yE-Jh
	for qemu-devel@nongnu.org; Wed, 02 Mar 2011 17:40:42 -0500
Received: by eyb6 with SMTP id 6so178779eyb.4
	for <qemu-devel@nongnu.org>; Wed, 02 Mar 2011 14:40:41 -0800 (PST)
MIME-Version: 1.0
In-Reply-To: <4D6EBE4B.8070705@mail.berlios.de>
References: <4D6DBDA4.3050909@cn.fujitsu.com> <4D6DC06B.6070308@cn.fujitsu.com>
	<AANLkTi=sjn2vHo7B-1yii4ofX5cseLei0u-BbWugdwt6@mail.gmail.com>
	<4D6E8E3A.50106@mail.berlios.de>
	<AANLkTi=29R6oLQQyumP2du8Bm-bZji98_Ah5M5UnHkns@mail.gmail.com>
	<4D6EBE4B.8070705@mail.berlios.de>
Date: Wed, 2 Mar 2011 22:40:41 +0000
Message-ID: <AANLkTi=7jCLkdBO-s_q-RmQ7DPEDa27F8FCCkNvduajZ@mail.gmail.com>
Subject: Re: [Qemu-devel] Re: [PATCH RESEND 2/2] vnc: Fix heap corruption
From: Peter Maydell <peter.maydell@linaro.org>
Content-Type: text/plain; charset=UTF-8
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Weil <weil@mail.berlios.de>
Cc: Anthony Liguori <aliguori@us.ibm.com>, qemu-devel <qemu-devel@nongnu.org>, Corentin Chary <corentin.chary@gmail.com>

On 2 March 2011 22:01, Stefan Weil <weil@mail.berlios.de> wrote:
> The part missing in my patch is correct handling of another
> rounding effect:
>
> VNC_DIRTY_WORDS is exact for 32 bit long values (and the
> "old" code which used uint32_t until some weeks ago), where
> VNC_DIRTY_WORDS = 2560/16/32 = 5.
>
> For 64 bit values, VNC_DIRTY_WORDS = 2560/16/64 = 2 (rounded)!

Yes, I noticed that after I posted. Given that we have arrays
like
     unsigned long dirty[VNC_MAX_HEIGHT][VNC_DIRTY_WORDS];
rounding down rather than up looks a bit suspicious...

(Can we just make VNC_MAX_WIDTH a multiple of 64, or is it
baked into the VNC protocol?)

-- PMM