| Message ID | 1298928892-24039-1-git-send-email-weil@mail.berlios.de |
|---|---|
| State | Superseded |
| Headers | show |
diff --git a/ui/vnc.c b/ui/vnc.c index af55156..89f71da 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2401,7 +2401,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) */ bitmap_set(width_mask, 0, (ds_get_width(vd->ds) / 16)); bitmap_clear(width_mask, (ds_get_width(vd->ds) / 16), - VNC_DIRTY_WORDS * BITS_PER_LONG); + (VNC_MAX_WIDTH - ds_get_width(vd->ds)) / 16); cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds); guest_row = vd->guest.ds->data; server_row = vd->server->data;
Commit bc2429b9174ac2d3c56b7fd35884b0d89ec7fb02 introduced a severe bug (heap corruption). bitmap_clear was called with a wrong argument which caused out-of-bound writes to width_mask. This bug was detected with QEMU running on windows. It also occurs with wine: *** stack smashing detected ***: terminated wine: Unhandled illegal instruction at address 0x6115c7 (thread 0009), starting debugger... The bug is not windows specific! Cc: Corentin Chary <corentincj@iksaif.net> Cc: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Stefan Weil <weil@mail.berlios.de> --- ui/vnc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)