Prevent SEGV in VNC server for old clients (Anthony Liguori).
If the client does not support the DesktopResize pseudo-encoding, then
vs->{width,height} may be smaller than ds->{width,height}.  dirty_row is
sized according to vs->{width,height}, not ds->{width,height}.
This patch makes sure to bound the update region to vs->{width,height} to
avoid a possible SEGV.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Reported-by: Marcelo Tosatti <mtosatti@redhat.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4502 c046a42c-6fe2-441c-8c8c-71466251a162
			
			
This commit is contained in:
		
							parent
							
								
									a2a64a1f2d
								
							
						
					
					
						commit
						788abf8e41
					
				
							
								
								
									
										5
									
								
								vnc.c
								
								
								
								
							
							
						
						
									
										5
									
								
								vnc.c
								
								
								
								
							| 
						 | 
				
			
			@ -265,6 +265,11 @@ static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
 | 
			
		|||
    w += (x % 16);
 | 
			
		||||
    x -= (x % 16);
 | 
			
		||||
 | 
			
		||||
    x = MIN(x, vs->width);
 | 
			
		||||
    y = MIN(y, vs->height);
 | 
			
		||||
    w = MIN(x + w, vs->width) - x;
 | 
			
		||||
    h = MIN(y + h, vs->height) - y;
 | 
			
		||||
 | 
			
		||||
    for (; y < h; y++)
 | 
			
		||||
	for (i = 0; i < w; i += 16)
 | 
			
		||||
	    vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
 | 
			
		||||
| 
						 | 
				
			
			
 | 
			
		|||
		Loading…
	
		Reference in New Issue