From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:35179)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <lists@wiesinger.com>) id 1S6m5y-0003My-Ib
	for qemu-devel@nongnu.org; Sun, 11 Mar 2012 12:58:11 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <lists@wiesinger.com>) id 1S6m5w-00074M-D2
	for qemu-devel@nongnu.org; Sun, 11 Mar 2012 12:58:10 -0400
Received: from chello084112167138.7.11.vie.surfer.at ([84.112.167.138]:44538
	helo=wiesinger.com) by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <lists@wiesinger.com>) id 1S6m5w-0006xz-2P
	for qemu-devel@nongnu.org; Sun, 11 Mar 2012 12:58:08 -0400
Date: Sun, 11 Mar 2012 17:56:17 +0100 (CET)
From: Gerhard Wiesinger <lists@wiesinger.com>
In-Reply-To: <20120305193347.GA31914@peqn>
Message-ID: <alpine.LFD.2.02.1203111754020.27347@bbs.intern>
References: <20120302211122.GA9652@vostro.hallyn.com>
	<20120302212030.GP21784@us.ibm.com> <20120305193347.GA31914@peqn>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Subject: Re: [Qemu-devel] [PATCH 1/1] vmware_vga: stop crashing
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Ryan Harper <ryanh@us.ibm.com>, qemu-devel@nongnu.org

Can confirm that this patch fixes a crash which also occoured here. Since 
window was out of the VNC window, crash was reproduceable and has been 
removed reproduceable.

Tested-by: Gerhard Wiesinger <lists@wiesinger.com>

Please apply ASAP.

Ciao,
Gerhard

--
http://www.wiesinger.com/


On Mon, 5 Mar 2012, Serge Hallyn wrote:

>
> if x or y < 0, set them to 0 (and decrement width/height accordingly)>
>
> I don't know where the best place to catch this would be, but
> with vnc and vmware_vga it's possible to get set_bit called on
> a negative index, crashing qemu.  See
>
> https://bugs.launchpad.net/ubuntu/+source/qemu-kvm/+bug/918791
>
> for details.  This patch prevents that.  It's possible this
> should be caught earlier, but this patch works for me.
>
> Changelog:
> 	Mar 5: As Ryan Harper pointed out, don't mix tabs+spaces,
> 	       and put {} around all conditionals.
>
> Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
> ---
> hw/vmware_vga.c |   18 ++++++++++++++++++
> 1 files changed, 18 insertions(+), 0 deletions(-)
>
> diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
> index 142d9f4..c94f9f3 100644
> --- a/hw/vmware_vga.c
> +++ b/hw/vmware_vga.c
> @@ -298,6 +298,24 @@ static inline void vmsvga_update_rect(struct vmsvga_state_s *s,
>     uint8_t *src;
>     uint8_t *dst;
>
> +    if (x < 0) {
> +        fprintf(stderr, "%s: update x was < 0 (%d, w %d)\n",
> +                        __FUNCTION__, x, w);
> +        w += x;
> +        if (w < 0) {
> +            return;
> +        }
> +        x = 0;
> +    }
> +    if (y < 0) {
> +        fprintf(stderr, "%s: update y was < 0 (%d, h %d)\n",
> +                        __FUNCTION__, y, h);
> +        h += y;
> +        if (h < 0) {
> +            return;
> +        }
> +        y = 0;
> +    }
>     if (x + w > s->width) {
>         fprintf(stderr, "%s: update width too large x: %d, w: %d\n",
>                         __FUNCTION__, x, w);
> -- 
> 1.7.9
>
>
>