diff mbox

[STABLE,0.14] vnc: Limit r/w access to size of allocated memory

Message ID 1300214639-5539-1-git-send-email-weil@mail.berlios.de
State New
Headers show

Commit Message

Stefan Weil March 15, 2011, 6:43 p.m. UTC 
This fixes memory reads and writes which exceeded the upper limit
of allocated memory vd->guest.ds->data and vd->server->data.

Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
---
 ui/vnc.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
diff mbox

Patch

diff --git a/ui/vnc.c b/ui/vnc.c
index f4fea04..013f5e3 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2273,6 +2273,9 @@  static int vnc_refresh_server_surface(VncDisplay *vd)
      */
     vnc_set_bits(width_mask, (ds_get_width(vd->ds) / 16), VNC_DIRTY_WORDS);
     cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
+    if (cmp_bytes > vd->ds->surface->linesize) {
+        cmp_bytes = vd->ds->surface->linesize;
+    }
     guest_row  = vd->guest.ds->data;
     server_row = vd->server->data;
     for (y = 0; y < vd->guest.ds->height; y++) {