[Spice-commits] server/red_worker.c

[Marc-André Lureau]

 server/red_worker.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 1898f3949cf75422aa1fedba40c429b28d8d6b67
Author: Marc-André Lureau <marcandre.lureau at gmail.com>
Date:   Wed Aug 6 18:34:56 2014 +0200

    Fix crash when clearing surface memory
    
    The beginning of the surface data needs to be computed correctly if the
    stride is negative, otherwise, it should point already to the beginning
    of the surface data. This bug seems to exists since 4a208b (0.5.2)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1029646

diff --git a/server/red_worker.c b/server/red_worker.c
index 6bdad93..35a1a04 100644
--- a/server/red_worker.c
+++ b/server/red_worker.c
@@ -9470,7 +9470,11 @@ static inline void red_create_surface(RedWorker *worker, uint32_t surface_id, ui
     surface->context.stride = stride;
     surface->context.line_0 = line_0;
     if (!data_is_valid) {
-        memset((char *)line_0 + (int32_t)(stride * (height - 1)), 0, height*abs(stride));
+        char *data = line_0;
+        if (stride < 0) {
+            data -= abs(stride) * (height - 1);
+        }
+        memset(data, 0, height*abs(stride));
     }
     surface->create.info = NULL;
     surface->destroy.info = NULL;