[Spice-devel] [PATCH spice] Fix crash when clearing surface memory

[Christophe Fergeau]

ACK

On Thu, Aug 07, 2014 at 11:47:07AM +0200, Marc-André Lureau wrote:
> The beginning of the surface data needs to be computed correctly if the
> stride is negative, otherwise, it should point already to the beginning
> of the surface data. This bug seems to exists since 4a208b (0.5.2)
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1029646
> ---
>  server/red_worker.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/server/red_worker.c b/server/red_worker.c
> index 6bdad93..35a1a04 100644
> --- a/server/red_worker.c
> +++ b/server/red_worker.c
> @@ -9470,7 +9470,11 @@ static inline void red_create_surface(RedWorker *worker, uint32_t surface_id, ui
>      surface->context.stride = stride;
>      surface->context.line_0 = line_0;
>      if (!data_is_valid) {
> -        memset((char *)line_0 + (int32_t)(stride * (height - 1)), 0, height*abs(stride));
> +        char *data = line_0;
> +        if (stride < 0) {
> +            data -= abs(stride) * (height - 1);
> +        }
> +        memset(data, 0, height*abs(stride));
>      }
>      surface->create.info = NULL;
>      surface->destroy.info = NULL;
> -- 
> 1.9.3
> 
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/spice-devel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/spice-devel/attachments/20140807/04512e6d/attachment.sig>