[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] vnc: Fix heap corruption
From: |
Stefan Weil |
Subject: |
[Qemu-devel] [PATCH] vnc: Fix heap corruption |
Date: |
Mon, 28 Feb 2011 22:34:52 +0100 |
Commit bc2429b9174ac2d3c56b7fd35884b0d89ec7fb02 introduced
a severe bug (heap corruption).
bitmap_clear was called with a wrong argument
which caused out-of-bound writes to width_mask.
This bug was detected with QEMU running on windows.
It also occurs with wine:
*** stack smashing detected ***: terminated
wine: Unhandled illegal instruction at address 0x6115c7 (thread 0009), starting
debugger...
The bug is not windows specific!
Cc: Corentin Chary <address@hidden>
Cc: Anthony Liguori <address@hidden>
Signed-off-by: Stefan Weil <address@hidden>
---
ui/vnc.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index af55156..89f71da 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2401,7 +2401,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
*/
bitmap_set(width_mask, 0, (ds_get_width(vd->ds) / 16));
bitmap_clear(width_mask, (ds_get_width(vd->ds) / 16),
- VNC_DIRTY_WORDS * BITS_PER_LONG);
+ (VNC_MAX_WIDTH - ds_get_width(vd->ds)) / 16);
cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
guest_row = vd->guest.ds->data;
server_row = vd->server->data;
--
1.7.2.3
- [Qemu-devel] [PATCH] vnc: Fix heap corruption,
Stefan Weil <=