diff options
| author | Stefan Weil <weil@mail.berlios.de> | 2012-03-14 07:58:48 +0100 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2012-03-14 16:22:46 -0500 |
| commit | 9e4dd565b46749d5e6d5cf87bfd84f1917c68319 (patch) | |
| tree | c3214b148f1e1f2b6d3da992dfa1d609b5cae113 | |
| parent | 175b2a6e4be06422da59d3a82c28d9a0e738e282 (diff) | |
| download | focaccia-qemu-9e4dd565b46749d5e6d5cf87bfd84f1917c68319.tar.gz focaccia-qemu-9e4dd565b46749d5e6d5cf87bfd84f1917c68319.zip | |
vnc: Limit r/w access to size of allocated memory
This fixes memory reads and writes which exceeded the upper limit of allocated memory vd->guest.ds->data and vd->server->data. Cc: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Stefan Weil <weil@mail.berlios.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
| -rw-r--r-- | ui/vnc.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ui/vnc.c b/ui/vnc.c index aef6d3af26..deb9ecd681 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2562,6 +2562,9 @@ static int vnc_refresh_server_surface(VncDisplay *vd) * Update server dirty map. */ cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds); + if (cmp_bytes > vd->ds->surface->linesize) { + cmp_bytes = vd->ds->surface->linesize; + } guest_row = vd->guest.ds->data; server_row = vd->server->data; for (y = 0; y < vd->guest.ds->height; y++) { |