From 4c93ce54e7114aae33100d2ee4f2b36e451a1d06 Mon Sep 17 00:00:00 2001 From: Mauro Matteo Cascella Date: Tue, 23 May 2023 18:30:23 +0200 Subject: ui/cursor: make width/height unsigned 16-bit integer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Although not actually exploitable at the moment, a negative width/height could make datasize wrap around and potentially lead to buffer overflow. Since there is no reason a negative width/height is ever appropriate, modify QEMUCursor struct and cursor_alloc prototype to accept uint16_t. This protects us against accidentally introducing future bugs. Signed-off-by: Mauro Matteo Cascella Reported-by: Jacek Halon Reported-by: Yair Mizrahi Reported-by: Elsayed El-Refa'ei Reviewed-by: Marc-André Lureau Reviewed-by: Daniel P. Berrangé Message-Id: <20230523163023.608121-1-mcascell@redhat.com> --- ui/cursor.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'ui/cursor.c') diff --git a/ui/cursor.c b/ui/cursor.c index 6fe6799..29717b3 100644 --- a/ui/cursor.c +++ b/ui/cursor.c @@ -90,11 +90,12 @@ QEMUCursor *cursor_builtin_left_ptr(void) return cursor_parse_xpm(cursor_left_ptr_xpm); } -QEMUCursor *cursor_alloc(int width, int height) +QEMUCursor *cursor_alloc(uint16_t width, uint16_t height) { QEMUCursor *c; size_t datasize = width * height * sizeof(uint32_t); + /* Modern physical hardware typically uses 512x512 sprites */ if (width > 512 || height > 512) { return NULL; } -- cgit v1.1