]> git.ipfire.org Git - thirdparty/qemu.git/commit
projects / thirdparty / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: de3ea06) | patch
vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow
authorRoland Dreier <rdreier@cisco.com>
Wed, 6 Jan 2010 04:43:34 +0000 (20:43 -0800)
committerAnthony Liguori <aliguori@us.ibm.com>
Mon, 11 Jan 2010 16:03:39 +0000 (10:03 -0600)
commite1daf40e3e61537da1509236dadc23ca8c4bc0e6
tree402f608ed493fa2f029e51187c57776bdaa09fe4tree
parentde3ea06d59a110eb401c543b992dd85779ed8362commit | diff
vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow

Check that the cursor dimensions passed from the guest for the
DEFINE_CURSOR command don't overflow the available space in the
cursor.image[] or cursor.mask[] arrays before copying data from the
guest into those arrays.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit f2d928d44ebc918750c94f3605c1417f1f653ec9)
hw/vmware_vga.c diff | blob | blame | history
Mirror of https://git.qemu.org/git/qemu.git