[Spice-devel] [PATCH] red-parse-qxl: Check consistency of QXL_DRAW_COPY operations

[Francois Gouget]

On Thu, 26 May 2016, Frediano Ziglio wrote:

> > 
> > The source area should not extend outside the source bitmap, or have
> > swapped coordinates.
> > 
> > Signed-off-by: Francois Gouget <fgouget at codeweavers.com>
> > ---
> > 
> > The patch could be wrong: I could not find any documentation, neither in
> > the code, neither in docs/Spice_protocol.odt, that says what should
> > happen if the src_area goes outside the src_bitmap, or if the src_area
> > boundaries are swapped.
> > 
> > For instance let's say we have a 100x100 src_bitmap.
> > What happens if src_area is:
> >  * ( 90, 90)-(110,110)
> >  * (-10,-10)-( 10, 10)
> >  * (110,  0)-(120, 10)
> >  * (90,   0)-(  0, 10)
> > 
> > This patch considers all these to be invalid.
> > 
> 
> Did you had these issues with some drivers ?
> I would also considering releasing QXL resource anyway.

No but if the QXL drivers are not to be trusted[1], then their data must 
be validated and to do that one needs to know what is valid and what is 
not.

[1]
https://lists.freedesktop.org/archives/spice-devel/2016-May/029037.html

-- 
Francois Gouget <fgouget at codeweavers.com>