summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGerd Hoffmann2014-08-29 09:27:52 +0200
committerGerd Hoffmann2014-09-01 10:19:03 +0200
commit503b3b33feca818baa4459aba286e54a528e5567 (patch)
tree8529bb5018ebc40965206147c655420d15047c34
parentMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140829'... (diff)
downloadqemu-503b3b33feca818baa4459aba286e54a528e5567.tar.gz
qemu-503b3b33feca818baa4459aba286e54a528e5567.tar.xz
qemu-503b3b33feca818baa4459aba286e54a528e5567.zip
qxl-render: add more sanity checks
Damn, the dirty rectangle values are signed integers. So the checks added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good enough, we also have to make sure they are not negative. [ Note: There must be something broken in spice-server so we get negative values in the first place. Bug opened: https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ] Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-rw-r--r--hw/display/qxl-render.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
index cc2c2b1dbc..bcc5c3701a 100644
--- a/hw/display/qxl-render.c
+++ b/hw/display/qxl-render.c
@@ -138,7 +138,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl)
if (qemu_spice_rect_is_empty(qxl->dirty+i)) {
break;
}
- if (qxl->dirty[i].left > qxl->dirty[i].right ||
+ if (qxl->dirty[i].left < 0 ||
+ qxl->dirty[i].top < 0 ||
+ qxl->dirty[i].left > qxl->dirty[i].right ||
qxl->dirty[i].top > qxl->dirty[i].bottom ||
qxl->dirty[i].right > qxl->guest_primary.surface.width ||
qxl->dirty[i].bottom > qxl->guest_primary.surface.height) {