Am 10.04.2011 00:17, schrieb Aurelien Jarno:
On Mon, Mar 21, 2011 at 09:34:38AM +0100, Corentin Chary wrote:
From: Stefan Weil <w...@mail.berlios.de>
This fixes memory reads and writes which exceeded the upper limit
of allocated memory vd->guest.ds->data and vd->server->data.
Cc: Anthony Liguori <aligu...@us.ibm.com>
Signed-off-by: Stefan Weil <w...@mail.berlios.de>
Signed-off-by: Corentin Chary <corentin.ch...@gmail.com>
---
ui/vnc.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index 90b6384..3138053 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2414,6 +2414,9 @@ static int
vnc_refresh_server_surface(VncDisplay *vd)
* Update server dirty map.
*/
cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
+ if (cmp_bytes > vd->ds->surface->linesize) {
+ cmp_bytes = vd->ds->surface->linesize;
+ }
What about using ds_get_linesize(vd->ds) instead?
Yes, that's better. Please either change the two lines, or
wait until I have sent a new version of the patch.
The patch should be applied to stable, too.
Thanks,
Stefan
