diff mbox

qxl: dont update invalid area

Message ID 1346345084-11345-1-git-send-email-riegamaths@gmail.com
State New
Headers show

Commit Message

dunrong huang Aug. 30, 2012, 4:44 p.m. UTC 
From: Dunrong Huang <riegamaths@gmail.com>

This patch fixes the following error:

$ ~/usr/bin/qemu-system-x86_64 -enable-kvm -m 1024 -spice port=5900,disable-ticketing -vga qxl -cdrom ~/Images/linuxmint-13-mate-dvd-32bit.iso
(/home/mathslinux/usr/bin/qemu-system-x86_64:10068): SpiceWorker-CRITICAL **: red_worker.c:4599:red_update_area: condition `area->left >= 0 && area->top >= 0 && area->left < area->right && area->top < area->bottom' failed
Aborted

spice server terminates QEMU process if we pass invalid area to it,
so dont update those invalid areas.

Signed-off-by: Dunrong Huang <riegamaths@gmail.com>
---
 hw/qxl.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

Comments

Gerd Hoffmann Sept. 6, 2012, 7:54 a.m. UTC | #1 
On 08/30/12 18:44, riegamaths@gmail.com wrote:
> This patch fixes the following error:
> 
> $ ~/usr/bin/qemu-system-x86_64 -enable-kvm -m 1024 -spice port=5900,disable-ticketing -vga qxl -cdrom ~/Images/linuxmint-13-mate-dvd-32bit.iso
> (/home/mathslinux/usr/bin/qemu-system-x86_64:10068): SpiceWorker-CRITICAL **: red_worker.c:4599:red_update_area: condition `area->left >= 0 && area->top >= 0 && area->left < area->right && area->top < area->bottom' failed
> Aborted
> 
> spice server terminates QEMU process if we pass invalid area to it,
> so dont update those invalid areas.

Patch added to spice patch queue.

thanks,
  Gerd
diff mbox

Patch

diff --git a/hw/qxl.c b/hw/qxl.c
index c2dd3b4..10e6bb3 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1385,6 +1385,13 @@  async_common:
         QXLCookie *cookie = NULL;
         QXLRect update = d->ram->update_area;
 
+        if (update.left < 0 || update.top < 0 || update.left >= update.right ||
+            update.top >= update.bottom) {
+            qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: "
+                              "invalid area(%d,%d,%d,%d)\n", update.left,
+                              update.right, update.top, update.bottom);
+            break;
+        }
         if (async == QXL_ASYNC) {
             cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
                                     QXL_IO_UPDATE_AREA_ASYNC);