diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2023-07-04 11:16:42 +0200 |
|---|---|---|
| committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2023-07-17 15:20:18 +0400 |
| commit | 9c18a9234bab9d5e903f897b30fb4a37888aebfc (patch) | |
| tree | 0d007dc3ca25e7a26f1982d63f77c8bb99ba31e7 /hw | |
| parent | ed8ad9728a9c0eec34db9dff61dfa2f1dd625637 (diff) | |
| download | qemu-9c18a9234bab9d5e903f897b30fb4a37888aebfc.zip qemu-9c18a9234bab9d5e903f897b30fb4a37888aebfc.tar.gz qemu-9c18a9234bab9d5e903f897b30fb4a37888aebfc.tar.bz2 | |
virtio-gpu: fix potential divide-by-zero regression
Commit 9462ff4695aa0 ("virtio-gpu/win32: allocate shareable 2d
resources/images") introduces a division, which can lead to crashes when
"height" is 0.
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1744
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/display/virtio-gpu.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index befa7d6..e937c4e 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -303,10 +303,11 @@ static void virtio_gpu_resource_create_2d(VirtIOGPU *g, goto end; } #endif - res->image = pixman_image_create_bits(pformat, - c2d.width, - c2d.height, - bits, res->hostmem / c2d.height); + res->image = pixman_image_create_bits( + pformat, + c2d.width, + c2d.height, + bits, c2d.height ? res->hostmem / c2d.height : 0); #ifdef WIN32 if (res->image) { pixman_image_set_destroy_function(res->image, win32_pixman_image_destroy, res->handle); @@ -1272,9 +1273,10 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size, return -EINVAL; } #endif - res->image = pixman_image_create_bits(pformat, - res->width, res->height, - bits, res->hostmem / res->height); + res->image = pixman_image_create_bits( + pformat, + res->width, res->height, + bits, res->height ? res->hostmem / res->height : 0); if (!res->image) { g_free(res); return -EINVAL; |