From: Stefan Weil <weil@mail.berlios.de>
Date: Wed, 14 Mar 2012 06:58:48 +0000 (+0100)
Subject: vnc: Limit r/w access to size of allocated memory
X-Git-Tag: v1.1-rc0~228
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9e4dd565b46749d5e6d5cf87bfd84f1917c68319;p=thirdparty%2Fqemu.git

vnc: Limit r/w access to size of allocated memory

This fixes memory reads and writes which exceeded the upper limit
of allocated memory vd->guest.ds->data and vd->server->data.

Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
---

diff --git a/ui/vnc.c b/ui/vnc.c
index aef6d3af260..deb9ecd6818 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2562,6 +2562,9 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
      * Update server dirty map.
      */
     cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
+    if (cmp_bytes > vd->ds->surface->linesize) {
+        cmp_bytes = vd->ds->surface->linesize;
+    }
     guest_row  = vd->guest.ds->data;
     server_row = vd->server->data;
     for (y = 0; y < vd->guest.ds->height; y++) {