diff options
| author | BALATON Zoltan <balaton@eik.bme.hu> | 2020-04-06 22:34:26 +0200 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2020-06-22 12:14:54 -0500 |
| commit | 01392ae31a38294c1771eeed0dada1e224493492 (patch) | |
| tree | 22e7d4510e89cac3b7d08d69ff49dff64afa46ae /qapi/qobject-output-visitor.c | |
| parent | 4e98c388d6b07a7b8b760491b07bcfd887c35e23 (diff) | |
| download | qemu-01392ae31a38294c1771eeed0dada1e224493492.zip qemu-01392ae31a38294c1771eeed0dada1e224493492.tar.gz qemu-01392ae31a38294c1771eeed0dada1e224493492.tar.bz2 | |
ati-vga: Fix checks in ati_2d_blt() to avoid crash
In some corner cases (that never happen during normal operation but a
malicious guest could program wrong values) pixman functions were
called with parameters that result in a crash. Fix this and add more
checks to disallow such cases.
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit ac2071c3791b67fc7af78b8ceb320c01ca1b5df7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'qapi/qobject-output-visitor.c')
0 files changed, 0 insertions, 0 deletions