[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 2/2] vnc: Limit r/w access to size of allocated memo
From: |
Corentin Chary |
Subject: |
[Qemu-devel] [PATCH 2/2] vnc: Limit r/w access to size of allocated memory |
Date: |
Wed, 14 Mar 2012 07:58:48 +0100 |
From: Stefan Weil <address@hidden>
This fixes memory reads and writes which exceeded the upper limit
of allocated memory vd->guest.ds->data and vd->server->data.
Cc: Anthony Liguori <address@hidden>
Signed-off-by: Stefan Weil <address@hidden>
---
ui/vnc.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index aef6d3a..deb9ecd 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2562,6 +2562,9 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
* Update server dirty map.
*/
cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
+ if (cmp_bytes > vd->ds->surface->linesize) {
+ cmp_bytes = vd->ds->surface->linesize;
+ }
guest_row = vd->guest.ds->data;
server_row = vd->server->data;
for (y = 0; y < vd->guest.ds->height; y++) {
--
1.7.3.4