aboutsummaryrefslogtreecommitdiff
path: root/vnc.c
diff options
context:
space:
mode:
authorbalrog <balrog@c046a42c-6fe2-441c-8c8c-71466251a162>2008-05-20 00:07:58 +0000
committerbalrog <balrog@c046a42c-6fe2-441c-8c8c-71466251a162>2008-05-20 00:07:58 +0000
commit788abf8e41e5fa33bfcd2245c3e3eb47d60ceef7 (patch)
treee2bd31624a490688671d9c71b53d7fe2b11c65e8 /vnc.c
parenta2a64a1f2db407fcebbf03c6e2b366bb2a2beecc (diff)
downloadqemu-788abf8e41e5fa33bfcd2245c3e3eb47d60ceef7.zip
qemu-788abf8e41e5fa33bfcd2245c3e3eb47d60ceef7.tar.gz
qemu-788abf8e41e5fa33bfcd2245c3e3eb47d60ceef7.tar.bz2
Prevent SEGV in VNC server for old clients (Anthony Liguori).
If the client does not support the DesktopResize pseudo-encoding, then vs->{width,height} may be smaller than ds->{width,height}. dirty_row is sized according to vs->{width,height}, not ds->{width,height}. This patch makes sure to bound the update region to vs->{width,height} to avoid a possible SEGV. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Reported-by: Marcelo Tosatti <mtosatti@redhat.com> git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4502 c046a42c-6fe2-441c-8c8c-71466251a162
Diffstat (limited to 'vnc.c')
-rw-r--r--vnc.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/vnc.c b/vnc.c
index 842124b..4b57838 100644
--- a/vnc.c
+++ b/vnc.c
@@ -265,6 +265,11 @@ static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
w += (x % 16);
x -= (x % 16);
+ x = MIN(x, vs->width);
+ y = MIN(y, vs->height);
+ w = MIN(x + w, vs->width) - x;
+ h = MIN(y + h, vs->height) - y;
+
for (; y < h; y++)
for (i = 0; i < w; i += 16)
vnc_set_bit(vs->dirty_row[y], (x + i) / 16);