qxl parser: complete QXL_SURFACE_CMD_CREATE parsing

3 files changed, 6 insertions, 4 deletions

diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c
index 127141c6..fb46bd8b 100644
--- a/server/red_parse_qxl.c
+++ b/server/red_parse_qxl.c
@@ -957,6 +957,7 @@ void red_get_surface_cmd(RedMemSlotInfo *slots, int group_id,
                          RedSurfaceCmd *red, QXLPHYSICAL addr)
 {
     QXLSurfaceCmd *qxl;
+    size_t size;
 
     qxl = (QXLSurfaceCmd *)get_virt(slots, addr, sizeof(*qxl), group_id);
     red->release_info     = &qxl->release_info;
@@ -971,7 +972,9 @@ void red_get_surface_cmd(RedMemSlotInfo *slots, int group_id,
         red->u.surface_create.width  = qxl->u.surface_create.width;
         red->u.surface_create.height = qxl->u.surface_create.height;
         red->u.surface_create.stride = qxl->u.surface_create.stride;
-        red->u.surface_create.data   = qxl->u.surface_create.data;
+        size = red->u.surface_create.height * abs(red->u.surface_create.stride);
+        red->u.surface_create.data =
+            (uint8_t*)get_virt(slots, qxl->u.surface_create.data, size, group_id);
         break;
     }
 }
diff --git a/server/red_parse_qxl.h b/server/red_parse_qxl.h
index e80da8a5..95408f77 100644
--- a/server/red_parse_qxl.h
+++ b/server/red_parse_qxl.h
@@ -79,7 +79,7 @@ typedef struct RedSurfaceCreate {
     uint32_t width;
     uint32_t height;
     int32_t stride;
-    SPICE_ADDRESS data;
+    uint8_t *data;
 } RedSurfaceCreate;
 
 typedef struct RedSurfaceCmd {
diff --git a/server/red_worker.c b/server/red_worker.c
index 27d94910..1ed7b831 100644
--- a/server/red_worker.c
+++ b/server/red_worker.c
@@ -3500,11 +3500,10 @@ static inline void red_process_surface(RedWorker *worker, RedSurfaceCmd *surface
 
     switch (surface->type) {
     case QXL_SURFACE_CMD_CREATE: {
-        unsigned long saved_data = (unsigned long)surface->u.surface_create.data;
         uint32_t height = surface->u.surface_create.height;
         int32_t stride = surface->u.surface_create.stride;
 
-        data = (uint8_t *)get_virt(&worker->mem_slots, saved_data, height * abs(stride), group_id);
+        data = surface->u.surface_create.data;
         if (stride < 0) {
             data -= (int32_t)(stride * (height - 1));
         }