Message ID | 1335345205-8908-3-git-send-email-alevy@redhat.com |
---|---|
State | New |
Headers | show |
diff --git a/hw/qxl.c b/hw/qxl.c index b6a738e..8b66cbb 100644 --- a/hw/qxl.c +++ b/hw/qxl.c @@ -394,7 +394,11 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) return 1; } uint32_t id = le32_to_cpu(cmd->surface_id); - PANIC_ON(id >= NUM_SURFACES); + + if (id >= NUM_SURFACES) { + qxl_guest_bug(qxl, "QXL_CMD_SURFACE id %d >= %d", id, NUM_SURFACES); + return 1; + } qemu_mutex_lock(&qxl->track_lock); if (cmd->type == QXL_SURFACE_CMD_CREATE) { qxl->guest_surfaces.cmds[id] = ext->cmd.data;
Signed-off-by: Alon Levy <alevy@redhat.com> --- hw/qxl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)