[Spice-devel] [PATCH] qxl: add sanity check

[Christophe Fergeau]

Looks good, ACK.

Christophe

On Wed, Feb 19, 2014 at 11:40:50AM +0100, Gerd Hoffmann wrote:
> Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
> ---
>  hw/display/qxl.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/display/qxl.c b/hw/display/qxl.c
> index 1471cc0..2a559eb 100644
> --- a/hw/display/qxl.c
> +++ b/hw/display/qxl.c
> @@ -1429,7 +1429,7 @@ static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async)
>      return 1;
>  }
>  
> -static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
> +static void qxl_set_mode(PCIQXLDevice *d, unsigned int modenr, int loadvm)
>  {
>      pcibus_t start = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;
>      pcibus_t end   = d->pci.io_regions[QXL_RAM_RANGE_INDEX].size + start;
> @@ -1439,6 +1439,12 @@ static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
>          .mem_start = start,
>          .mem_end = end
>      };
> +
> +    if (modenr >= d->modes->n_modes) {
> +        qxl_set_guest_bug(d, "mode number out of range");
> +        return;
> +    }
> +
>      QXLSurfaceCreate surface = {
>          .width      = mode->x_res,
>          .height     = mode->y_res,
> -- 
> 1.8.3.1
> 
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/spice-devel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/spice-devel/attachments/20140220/ccdae210/attachment.pgp>