aboutsummaryrefslogtreecommitdiff
path: root/ui
diff options
context:
space:
mode:
authorGerd Hoffmann <kraxel@redhat.com>2010-06-14 12:28:23 +0200
committerGerd Hoffmann <kraxel@redhat.com>2012-02-10 09:58:33 +0100
commitce3e14175ea36d851aede808fc8891313b91ec27 (patch)
tree80b4c420729f086b03f457b37e53fea81900b185 /ui
parent57c83dacfe179bf061b8fa79d9553ebabe4d2ff4 (diff)
Fix vnc memory corruption with width = 1400
vnc assumes that the screen width is a multiple of 16 in several places. If this is not the case vnc will overrun buffers, corrupt memory, make qemu crash. This is the minimum fix for this bug. It makes sure we don't overrun the scanline, thereby fixing the segfault. The rendering is *not* correct though, there is a black border at the right side of the screen, 8 pixels wide because 1400 % 16 == 8. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'ui')
-rw-r--r--ui/vnc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/ui/vnc.c b/ui/vnc.c
index 16b79ec423..5752bf8740 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2445,7 +2445,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
guest_ptr = guest_row;
server_ptr = server_row;
- for (x = 0; x < vd->guest.ds->width;
+ for (x = 0; x + 15 < vd->guest.ds->width;
x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
if (!test_and_clear_bit((x / 16), vd->guest.dirty[y]))
continue;