server: don't abort on guest images with missing palettes

2 files changed, 13 insertions, 0 deletions

diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c
index e6c27053..daae897f 100644
--- a/server/red_parse_qxl.c
+++ b/server/red_parse_qxl.c
@@ -328,6 +328,10 @@ static SpiceChunks *red_get_image_data_chunked(RedMemSlotInfo *slots, int group_
     return data;
 }
 
+// This is based on SPICE_BITMAP_FMT_*, copied from server/red_worker.c
+// to avoid a possible unoptimization from making it non static.
+static const int BITMAP_FMT_IS_RGB[] = {0, 0, 0, 0, 0, 0, 1, 1, 1, 1};
+
 static SpiceImage *red_get_image(RedMemSlotInfo *slots, int group_id,
                                  QXLPHYSICAL addr, uint32_t flags)
 {
@@ -362,6 +366,11 @@ static SpiceImage *red_get_image(RedMemSlotInfo *slots, int group_id,
     switch (red->descriptor.type) {
     case SPICE_IMAGE_TYPE_BITMAP:
         red->u.bitmap.format = qxl->bitmap.format;
+        if (!bitmap_fmt_is_rgb(qxl->bitmap.format) && !qxl->bitmap.palette) {
+            spice_warning("guest error: missing palette on bitmap format=%d\n",
+                          red->u.bitmap.format);
+            return NULL;
+        }
         qxl_flags = qxl->bitmap.flags;
         if (qxl_flags & QXL_BITMAP_TOP_DOWN) {
             red->u.bitmap.flags = SPICE_BITMAP_FLAGS_TOP_DOWN;
diff --git a/server/red_worker.c b/server/red_worker.c
index 71df5a15..5634db58 100644
--- a/server/red_worker.c
+++ b/server/red_worker.c
@@ -6014,6 +6014,10 @@ static inline int red_lz_compress_image(DisplayChannelClient *dcc,
         o_comp_data->comp_buf = lz_data->data.bufs_head;
         o_comp_data->comp_buf_size = size;
     } else {
+        if (!src->palette) {
+            spice_warning("bad guest: missing palette\n");
+            return FALSE;
+        }
         dest->descriptor.type = SPICE_IMAGE_TYPE_LZ_PLT;
         dest->u.lz_plt.data_size = size;
         dest->u.lz_plt.flags = src->flags & SPICE_BITMAP_FLAGS_TOP_DOWN;