diff options
| author | Mauro Matteo Cascella <mcascell@redhat.com> | 2023-05-23 18:30:23 +0200 |
|---|---|---|
| committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2023-05-28 13:08:25 +0400 |
| commit | 4c93ce54e7114aae33100d2ee4f2b36e451a1d06 (patch) | |
| tree | 9b07ff722c0331548aefff62fabd76ad389d3870 /hw/input/virtio-input-hid.c | |
| parent | 1dfea3f212e43bfd59d1e1f40b9776db440b211f (diff) | |
| download | focaccia-qemu-4c93ce54e7114aae33100d2ee4f2b36e451a1d06.tar.gz focaccia-qemu-4c93ce54e7114aae33100d2ee4f2b36e451a1d06.zip | |
ui/cursor: make width/height unsigned 16-bit integer
Although not actually exploitable at the moment, a negative width/height could make datasize wrap around and potentially lead to buffer overflow. Since there is no reason a negative width/height is ever appropriate, modify QEMUCursor struct and cursor_alloc prototype to accept uint16_t. This protects us against accidentally introducing future bugs. Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reported-by: Jacek Halon <jacek.halon@gmail.com> Reported-by: Yair Mizrahi <yairh33@gmail.com> Reported-by: Elsayed El-Refa'ei <e.elrefaei99@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20230523163023.608121-1-mcascell@redhat.com>
Diffstat (limited to 'hw/input/virtio-input-hid.c')
0 files changed, 0 insertions, 0 deletions