Patchwork Fix vnc memory corruption with width = 1400

login
register
mail settings
Submitter Gerd Hoffmann
Date Jan. 24, 2011, 9:02 p.m.
Message ID <1295902977-5490-1-git-send-email-kraxel@redhat.com>
Download mbox | patch
Permalink /patch/80247/
State New
Headers show

Comments

Gerd Hoffmann - Jan. 24, 2011, 9:02 p.m.
[ note: found while cleaning up my git branches, must be quite old,
        rebase worked fine, looks like this one never made it upstream,
        resubmitting now ... ]

vnc assumes that the screen width is a multiple of 16 in several places.
If this is not the case vnc will overrun buffers, corrupt memory, make
qemu crash.

This is the minimum fix for this bug. It makes sure we don't overrun the
scanline, thereby fixing the segfault.  The rendering is *not* correct
though, there is a black border at the right side of the screen, 8
pixels wide because 1400 % 16 == 8.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 ui/vnc.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Patch

diff --git a/ui/vnc.c b/ui/vnc.c
index 495d6d6..592be8e 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2284,7 +2284,7 @@  static int vnc_refresh_server_surface(VncDisplay *vd)
             guest_ptr  = guest_row;
             server_ptr = server_row;
 
-            for (x = 0; x < vd->guest.ds->width;
+            for (x = 0; x + 15 < vd->guest.ds->width;
                     x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
                 if (!vnc_get_bit(vd->guest.dirty[y], (x / 16)))
                     continue;