From 02503a81bb6718f163256371598f71a6a26f89c7 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Mon, 14 Jun 2010 09:08:44 -0300 Subject: [PATCH 1/5] fix vnc memory corruption with width = 1400 RH-Author: Gerd Hoffmann Message-id: <1276506524-20807-1-git-send-email-kraxel@redhat.com> Patchwork-id: 9881 O-Subject: [RHEL-6 kvm PATCH] fix vnc memory corruption with width = 1400 Bugzilla: 602724 RH-Acked-by: Paolo Bonzini RH-Acked-by: Juan Quintela RH-Acked-by: Markus Armbruster vnc assumes that the screen width is a multiple of 16 in several places. If this is not the case vnc will overrun buffers, corrupt memory, make qemu crash. This is the minimum fix for this bug. It makes sure we don't overrun the scanline, thereby fixing the segfault. The rendering is *not* correct though, there is a black border at the right side of the screen, 8 pixels wide because 1400 % 16 == 8. bugzilla: #602724 Signed-off-by: Gerd Hoffmann --- vnc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) Signed-off-by: Eduardo Habkost --- vnc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/vnc.c b/vnc.c index 0467056..e83a6d4 100644 --- a/vnc.c +++ b/vnc.c @@ -2358,7 +2358,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) guest_ptr = guest_row; server_ptr = server_row; - for (x = 0; x < vd->guest.ds->width; + for (x = 0; x + 15 < vd->guest.ds->width; x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { if (!vnc_get_bit(vd->guest.dirty[y], (x / 16))) continue; -- 1.7.0.3