From patchwork Tue Mar 1 01:34:25 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wen Congyang X-Patchwork-Id: 84887 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 845F6B70E8 for ; Tue, 1 Mar 2011 12:37:26 +1100 (EST) Received: from localhost ([127.0.0.1]:47100 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PuEWh-0006Mb-Tr for incoming@patchwork.ozlabs.org; Mon, 28 Feb 2011 20:37:23 -0500 Received: from [140.186.70.92] (port=37456 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PuEV9-0005kp-Fg for qemu-devel@nongnu.org; Mon, 28 Feb 2011 20:35:48 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PuEV8-0006ph-3a for qemu-devel@nongnu.org; Mon, 28 Feb 2011 20:35:47 -0500 Received: from [222.73.24.84] (port=59896 helo=song.cn.fujitsu.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PuEV7-0006or-Na for qemu-devel@nongnu.org; Mon, 28 Feb 2011 20:35:46 -0500 Received: from tang.cn.fujitsu.com (tang.cn.fujitsu.com [10.167.250.3]) by song.cn.fujitsu.com (Postfix) with ESMTP id 04406170129; Tue, 1 Mar 2011 09:35:35 +0800 (CST) Received: from mailserver.fnst.cn.fujitus.com (tang.cn.fujitsu.com [127.0.0.1]) by tang.cn.fujitsu.com (8.14.3/8.13.1) with ESMTP id p211TkNN007620; Tue, 1 Mar 2011 09:29:46 +0800 Received: from [10.167.225.226] ([10.167.225.226]) by mailserver.fnst.cn.fujitus.com (Lotus Domino Release 8.5.1FP4) with ESMTP id 2011030109342828-246033 ; Tue, 1 Mar 2011 09:34:28 +0800 Message-ID: <4D6C4D21.9060204@cn.fujitsu.com> Date: Tue, 01 Mar 2011 09:34:25 +0800 From: Wen Congyang User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.9) Gecko/20100413 Fedora/3.0.4-2.fc13 Thunderbird/3.0.4 MIME-Version: 1.0 To: Stefan Weil Subject: Re: [Qemu-devel] [PATCH] vnc: Fix heap corruption References: <1298928892-24039-1-git-send-email-weil@mail.berlios.de> In-Reply-To: <1298928892-24039-1-git-send-email-weil@mail.berlios.de> X-MIMETrack: Itemize by SMTP Server on mailserver/fnst(Release 8.5.1FP4|July 25, 2010) at 2011-03-01 09:34:28, Serialize by Router on mailserver/fnst(Release 8.5.1FP4|July 25, 2010) at 2011-03-01 09:34:28, Serialize complete at 2011-03-01 09:34:28 X-detected-operating-system: by eggs.gnu.org: FreeBSD 6.x (1) X-Received-From: 222.73.24.84 Cc: Corentin Chary , Anthony Liguori , qemu-devel@nongnu.org X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org At 03/01/2011 05:34 AM, Stefan Weil Write: > Commit bc2429b9174ac2d3c56b7fd35884b0d89ec7fb02 introduced > a severe bug (heap corruption). > > bitmap_clear was called with a wrong argument > which caused out-of-bound writes to width_mask. > > This bug was detected with QEMU running on windows. > It also occurs with wine: > > *** stack smashing detected ***: terminated > wine: Unhandled illegal instruction at address 0x6115c7 (thread 0009), starting debugger... > > The bug is not windows specific! > > Cc: Corentin Chary > Cc: Anthony Liguori > Signed-off-by: Stefan Weil > --- > ui/vnc.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/ui/vnc.c b/ui/vnc.c > index af55156..89f71da 100644 > --- a/ui/vnc.c > +++ b/ui/vnc.c > @@ -2401,7 +2401,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) > */ > bitmap_set(width_mask, 0, (ds_get_width(vd->ds) / 16)); > bitmap_clear(width_mask, (ds_get_width(vd->ds) / 16), > - VNC_DIRTY_WORDS * BITS_PER_LONG); > + (VNC_MAX_WIDTH - ds_get_width(vd->ds)) / 16); The third argument of bitmap_clear() is number of bits to be cleared, but we pass the end bits to be cleared to bitmap_clear(). I think we can fix this bug like this(I can not reproduce this bug, so I do not know whether it can fix this bug): Thanks Wen Congyang > cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds); > guest_row = vd->guest.ds->data; > server_row = vd->server->data; diff --git a/ui/vnc.c b/ui/vnc.c index fff34af..6d54661 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2404,7 +2404,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) */ bitmap_set(width_mask, 0, (ds_get_width(vd->ds) / 16)); bitmap_clear(width_mask, (ds_get_width(vd->ds) / 16), - VNC_DIRTY_WORDS * BITS_PER_LONG); + VNC_DIRTY_WORDS * BITS_PER_LONG - (ds_get_width(vd->ds) / 16)); cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds); guest_row = vd->guest.ds->data; server_row = vd->server->data;