From 788abf8e41e5fa33bfcd2245c3e3eb47d60ceef7 Mon Sep 17 00:00:00 2001 From: balrog Date: Tue, 20 May 2008 00:07:58 +0000 Subject: [PATCH] Prevent SEGV in VNC server for old clients (Anthony Liguori). If the client does not support the DesktopResize pseudo-encoding, then vs->{width,height} may be smaller than ds->{width,height}. dirty_row is sized according to vs->{width,height}, not ds->{width,height}. This patch makes sure to bound the update region to vs->{width,height} to avoid a possible SEGV. Signed-off-by: Anthony Liguori Reported-by: Marcelo Tosatti git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4502 c046a42c-6fe2-441c-8c8c-71466251a162 --- vnc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/vnc.c b/vnc.c index 842124b..4b57838 100644 --- a/vnc.c +++ b/vnc.c @@ -265,6 +265,11 @@ static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h) w += (x % 16); x -= (x % 16); + x = MIN(x, vs->width); + y = MIN(y, vs->height); + w = MIN(x + w, vs->width) - x; + h = MIN(y + h, vs->height) - y; + for (; y < h; y++) for (i = 0; i < w; i += 16) vnc_set_bit(vs->dirty_row[y], (x + i) / 16); -- 2.7.4