[Qemu-commits] [qemu/qemu] 4c956b: ui: avoid sign extension using client width/height

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 4c956bd81e2e16afd19d38d1fdeba6d9faa8a1ae
      
https://github.com/qemu/qemu/commit/4c956bd81e2e16afd19d38d1fdeba6d9faa8a1ae
  Author: Daniel P. Berrange <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M ui/vnc.c
    M ui/vnc.h

  Log Message:
  -----------
  ui: avoid sign extension using client width/height

Pixman returns a signed int for the image width/height, but the VNC
protocol only permits a unsigned int16. Effective framebuffer size
is determined by the guest, limited by the video RAM size, so the
dimensions are unlikely to exceed the range of an unsigned int16,
but this is not currently validated.

With the current use of 'int' for client width/height, the calculation
of offsets in vnc_update_throttle_offset() suffers from integer size
promotion and sign extension, causing coverity warnings

*** CID 1385147:  Integer handling issues  (SIGN_EXTENSION)
/ui/vnc.c: 979 in vnc_update_throttle_offset()
973      * than that the client would already suffering awful audio
974      * glitches, so dropping samples is no worse really).
975      */
976     static void vnc_update_throttle_offset(VncState *vs)
977     {
978         size_t offset =
>>>     CID 1385147:  Integer handling issues  (SIGN_EXTENSION)
>>>     Suspicious implicit sign extension:
    "vs->client_pf.bytes_per_pixel" with type "unsigned char" (8 bits,
    unsigned) is promoted in "vs->client_width * vs->client_height *
    vs->client_pf.bytes_per_pixel" to type "int" (32 bits, signed), then
    sign-extended to type "unsigned long" (64 bits, unsigned).  If
    "vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel"
    is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
979             vs->client_width * vs->client_height * 
vs->client_pf.bytes_per_pixel;

Change client_width / client_height to be a size_t to avoid sign
extension and integer promotion. Then validate that dimensions are in
range wrt the RFB protocol u16 limits.

Signed-off-by: Daniel P. Berrange <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: ed7b2624f241b58ca9e5437470339d60bf87e231
      
https://github.com/qemu/qemu/commit/ed7b2624f241b58ca9e5437470339d60bf87e231
  Author: Daniel P. Berrange <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M Makefile
    M include/ui/input.h
    M ui/input-keymap.c
    M ui/sdl2-input.c
    R ui/sdl2-keymap.h

  Log Message:
  -----------
  ui: convert the SDL2 frontend to keycodemapdb

The SDL2 scancodes are conveniently identical to the USB
scancodes. Replace the sdl2_scancode_to_qcode table with
an automatically generated table.

Missing entries in sdl2_scancode_to_qcode now fixed:

  - 0x32 -> Q_KEY_CODE_BACKSLASH
  - 0x66 -> Q_KEY_CODE_POWER
  - 0x67 -> Q_KEY_CODE_KP_EQUALS
  - 0x74 -> Q_KEY_CODE_OPEN
  - 0x77 -> Q_KEY_CODE_FRONT
  - 0x7f -> Q_KEY_CODE_AUDIOMUTE
  - 0x80 -> Q_KEY_CODE_VOLUMEUP
  - 0x81 -> Q_KEY_CODE_VOLUMEDOWN
  - 0x85 -> Q_KEY_CODE_KP_COMMA
  - 0x87 -> Q_KEY_CODE_RO
  - 0x89 -> Q_KEY_CODE_YEN
  - 0x8a -> Q_KEY_CODE_HENKAN
  - 0x93 -> Q_KEY_CODE_HIRAGANA
  - 0xe8 -> Q_KEY_CODE_AUDIOPLAY
  - 0xe9 -> Q_KEY_CODE_AUDIOSTOP
  - 0xea -> Q_KEY_CODE_AUDIOPREV
  - 0xeb -> Q_KEY_CODE_AUDIONEXT
  - 0xed -> Q_KEY_CODE_VOLUMEUP
  - 0xee -> Q_KEY_CODE_VOLUMEDOWN
  - 0xef -> Q_KEY_CODE_AUDIOMUTE
  - 0xf1 -> Q_KEY_CODE_AC_BACK
  - 0xf2 -> Q_KEY_CODE_AC_FORWARD
  - 0xf3 -> Q_KEY_CODE_STOP
  - 0xf4 -> Q_KEY_CODE_FIND
  - 0xf8 -> Q_KEY_CODE_SLEEP
  - 0xfa -> Q_KEY_CODE_AC_REFRESH
  - 0xfb -> Q_KEY_CODE_CALCULATOR

And some mistakes corrected:

  - 0x65 -> Q_KEY_CODE_COMPOSE, not duplicating Q_KEY_CODE_MENU

Signed-off-by: Daniel P. Berrange <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 2ec78706d188df7d3dab43d07b19b05ef7800a44
      
https://github.com/qemu/qemu/commit/2ec78706d188df7d3dab43d07b19b05ef7800a44
  Author: Daniel P. Berrange <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M Makefile
    M include/ui/input.h
    M ui/Makefile.objs
    M ui/gtk.c
    M ui/input-keymap.c
    M ui/sdl.c
    M ui/trace-events
    M ui/x_keymap.c
    M ui/x_keymap.h

  Log Message:
  -----------
  ui: convert GTK and SDL1 frontends to keycodemapdb

The x_keycode_to_pc_keycode and evdev_keycode_to_pc_keycode
tables are replaced with automatically generated tables.
In addition the X11 heuristics are improved to detect running
on XQuartz and XWin X11 servers, to activate the correct OS-X
and Win32 keycode maps.

Signed-off-by: Daniel P. Berrange <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 8026a81aa41a7fa1f70ddd9f060b6c683377704f
      
https://github.com/qemu/qemu/commit/8026a81aa41a7fa1f70ddd9f060b6c683377704f
  Author: Daniel P. Berrange <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M ui/gtk.c

  Log Message:
  -----------
  ui: add fix for GTK Pause key handling on Win32

Versions of GTK prior to 3.22 did not correctly set the keyval
field when VK_PAUSE was received on Windows.

Signed-off-by: Daniel P. Berrange <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 08774f66cb9ae686d61c221574505043215db90e
      
https://github.com/qemu/qemu/commit/08774f66cb9ae686d61c221574505043215db90e
  Author: Daniel P. Berrange <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M ui/gtk.c

  Log Message:
  -----------
  ui: ignore hardware keycode 255 on win32

It is a reserved value and doesn't have a corresponding
valid scancode.

Signed-off-by: Daniel P. Berrange <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: e52c6ba34149b4f39c3fd60e59ee32b809db2bfa
      
https://github.com/qemu/qemu/commit/e52c6ba34149b4f39c3fd60e59ee32b809db2bfa
  Author: Daniel P. Berrange <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M configure
    M qemu-doc.texi
    M ui/sdl.c

  Log Message:
  -----------
  ui: deprecate use of SDL 1.2 in favour of 2.0 series

The SDL 2.0 release was made in Aug, 2013:

  https://www.libsdl.org/release/

That will soon be 4 + 1/2 years ago, which is enough time to consider
the 2.0 series widely supported.

Thus we deprecate the SDL 1.2 support, which will allow us to delete it
in the last release of 2018. By this time, SDL 2.0 will be more than 5
years old.

Signed-off-by: Daniel P. Berrange <address@hidden>
Reviewed-by: Marc-André Lureau <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: f8d2c9369b8302f65f4f43f14ed3987c2268a02a
      
https://github.com/qemu/qemu/commit/f8d2c9369b8302f65f4f43f14ed3987c2268a02a
  Author: Gerd Hoffmann <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M ui/sdl.c
    M ui/sdl2.c

  Log Message:
  -----------
  sdl: use ctrl-alt-g as grab hotkey

Be consistent with gtk and cocoa.

Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: 04ff1a398a8d6e912eceaca9b62af0a09e927d63
      
https://github.com/qemu/qemu/commit/04ff1a398a8d6e912eceaca9b62af0a09e927d63
  Author: Gerd Hoffmann <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M include/sysemu/sysemu.h
    M include/ui/console.h
    M ui/sdl.c
    M ui/sdl2.c
    M vl.c

  Log Message:
  -----------
  sdl: reorganize -no-frame support

Drop no_frame flag from sdl_display_init argument list, use a global
variable instead.  This is temporary until -no-frame support is dropped
altogether when we remove sdl1 support.

Remove any traces of noframe from sdl2 code.  It is just dead code as
sdl2 doesn't support the SDL_NOFRAME window flag any more.

Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: d2bc6e1f62241085351005c88bed0b576b23da91
      
https://github.com/qemu/qemu/commit/d2bc6e1f62241085351005c88bed0b576b23da91
  Author: Peter Maydell <address@hidden>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M Makefile
    M configure
    M include/sysemu/sysemu.h
    M include/ui/console.h
    M include/ui/input.h
    M qemu-doc.texi
    M ui/Makefile.objs
    M ui/gtk.c
    M ui/input-keymap.c
    M ui/sdl.c
    M ui/sdl2-input.c
    R ui/sdl2-keymap.h
    M ui/sdl2.c
    M ui/trace-events
    M ui/vnc.c
    M ui/vnc.h
    M ui/x_keymap.c
    M ui/x_keymap.h
    M vl.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180125-pull-request' 
into staging

ui: convert to keycodedb, fix sign extension
sdl: cleanups, deprecate sdl 1.2

# gpg: Signature made Thu 25 Jan 2018 14:31:47 GMT
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <address@hidden>"
# gpg:                 aka "Gerd Hoffmann <address@hidden>"
# gpg:                 aka "Gerd Hoffmann (private) <address@hidden>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20180125-pull-request:
  sdl: reorganize -no-frame support
  sdl: use ctrl-alt-g as grab hotkey
  ui: deprecate use of SDL 1.2 in favour of 2.0 series
  ui: ignore hardware keycode 255 on win32
  ui: add fix for GTK Pause key handling on Win32
  ui: convert GTK and SDL1 frontends to keycodemapdb
  ui: convert the SDL2 frontend to keycodemapdb
  ui: avoid sign extension using client width/height

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/2077fef91d5e...d2bc6e1f6224