diff options
Diffstat (limited to 'hw/display')
| -rw-r--r-- | hw/display/qxl-render.c | 6 | ||||
| -rw-r--r-- | hw/display/qxl.c | 6 |
2 files changed, 11 insertions, 1 deletions
diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index 84f1367716..cc2c2b1dbc 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -138,6 +138,12 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) if (qemu_spice_rect_is_empty(qxl->dirty+i)) { break; } + if (qxl->dirty[i].left > qxl->dirty[i].right || + qxl->dirty[i].top > qxl->dirty[i].bottom || + qxl->dirty[i].right > qxl->guest_primary.surface.width || + qxl->dirty[i].bottom > qxl->guest_primary.surface.height) { + continue; + } qxl_blit(qxl, qxl->dirty+i); dpy_gfx_update(vga->con, qxl->dirty[i].left, qxl->dirty[i].top, diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 7fb83e4eaf..736fd3c4e2 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -710,7 +710,11 @@ static void interface_release_resource(QXLInstance *sin, if (ext.group_id == MEMSLOT_GROUP_HOST) { /* host group -> vga mode update request */ - qemu_spice_destroy_update(&qxl->ssd, (void *)(intptr_t)ext.info->id); + QXLCommandExt *cmdext = (void *)(ext.info->id); + SimpleSpiceUpdate *update; + g_assert(cmdext->cmd.type == QXL_CMD_DRAW); + update = container_of(cmdext, SimpleSpiceUpdate, ext); + qemu_spice_destroy_update(&qxl->ssd, update); return; } |