if x or y < 0, set them to 0 (and decrement width/height accordingly)>
I don't know where the best place to catch this would be, but
with vnc and vmware_vga it's possible to get set_bit called on
a negative index, crashing qemu. See
https://bugs.launchpad.net/ubuntu/+source/qemu-kvm/+bug/918791
for details. This patch prevents that. It's possible this
should be caught earlier, but this patch works for me.
Changelog:
Mar 5: As Ryan Harper pointed out, don't mix tabs+spaces,
and put {} around all conditionals.
Signed-off-by: Serge Hallyn <address@hidden>
---
hw/vmware_vga.c | 18 ++++++++++++++++++
1 files changed, 18 insertions(+), 0 deletions(-)
diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
index 142d9f4..c94f9f3 100644
--- a/hw/vmware_vga.c
+++ b/hw/vmware_vga.c
@@ -298,6 +298,24 @@ static inline void vmsvga_update_rect(struct
vmsvga_state_s *s,
uint8_t *src;
uint8_t *dst;
+ if (x < 0) {
+ fprintf(stderr, "%s: update x was < 0 (%d, w %d)\n",
+ __FUNCTION__, x, w);
+ w += x;
+ if (w < 0) {
+ return;
+ }
+ x = 0;
+ }
+ if (y < 0) {
+ fprintf(stderr, "%s: update y was < 0 (%d, h %d)\n",
+ __FUNCTION__, y, h);
+ h += y;
+ if (h < 0) {
+ return;
+ }
+ y = 0;
+ }
if (x + w > s->width) {
fprintf(stderr, "%s: update width too large x: %d, w: %d\n",
__FUNCTION__, x, w);
--
1.7.9