diff options
| author | Alon Levy <alevy@redhat.com> | 2012-07-20 18:23:58 +0300 |
|---|---|---|
| committer | Alon Levy <alevy@redhat.com> | 2012-07-22 13:37:44 +0300 |
| commit | 827f40e05c0340293711f1cd7f164abcc1da8789 (patch) | |
| tree | 8bb0bc63c9b43ba5951746533627165cb6549b0e | |
| parent | 341d273badace51107bbfcf1df30fa071fff38b8 (diff) | |
| download | spice-827f40e05c0340293711f1cd7f164abcc1da8789.tar.gz spice-827f40e05c0340293711f1cd7f164abcc1da8789.tar.xz spice-827f40e05c0340293711f1cd7f164abcc1da8789.zip | |
server/red_parse_qxl: disallow zero area bitmaps
prevents division by zero later (SIGFPE, Arithmetic exception) in
spice-common code, at spice-common/common/canvas_base.c:646
for both client and server (server only upon rendering).
| -rw-r--r-- | server/red_parse_qxl.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c index 71991ca9..deab38f2 100644 --- a/server/red_parse_qxl.c +++ b/server/red_parse_qxl.c @@ -370,6 +370,10 @@ static SpiceImage *red_get_image(RedMemSlotInfo *slots, int group_id, red->u.bitmap.format); return NULL; } + if (qxl->bitmap.x == 0 || qxl->bitmap.y == 0) { + spice_warning("guest error: zero area bitmap\n"); + return NULL; + } qxl_flags = qxl->bitmap.flags; if (qxl_flags & QXL_BITMAP_TOP_DOWN) { red->u.bitmap.flags = SPICE_BITMAP_FLAGS_TOP_DOWN; |