Commit 788abf8e41e5fa33bfcd2245c3e3eb47d60ceef7
1 parent
a2a64a1f
Prevent SEGV in VNC server for old clients (Anthony Liguori).
If the client does not support the DesktopResize pseudo-encoding, then
vs->{width,height} may be smaller than ds->{width,height}. dirty_row is
sized according to vs->{width,height}, not ds->{width,height}.
This patch makes sure to bound the update region to vs->{width,height} to
avoid a possible SEGV.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Reported-by: Marcelo Tosatti <mtosatti@redhat.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4502 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
1 changed file
with
5 additions
and
0 deletions
vnc.c
| ... | ... | @@ -265,6 +265,11 @@ static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h) |
| 265 | 265 | w += (x % 16); |
| 266 | 266 | x -= (x % 16); |
| 267 | 267 | |
| 268 | + x = MIN(x, vs->width); | |
| 269 | + y = MIN(y, vs->height); | |
| 270 | + w = MIN(x + w, vs->width) - x; | |
| 271 | + h = MIN(y + h, vs->height) - y; | |
| 272 | + | |
| 268 | 273 | for (; y < h; y++) |
| 269 | 274 | for (i = 0; i < w; i += 16) |
| 270 | 275 | vnc_set_bit(vs->dirty_row[y], (x + i) / 16); | ... | ... |