diff options
| author | Frediano Ziglio <fziglio@redhat.com> | 2015-09-08 10:05:20 +0100 |
|---|---|---|
| committer | Frediano Ziglio <fziglio@redhat.com> | 2015-10-06 11:11:10 +0100 |
| commit | dfaedec7890069b35f513e4a8ab4071ca54259ff (patch) | |
| tree | 92659759f65f423374e5c9992d574260fee196e2 /server/red_parse_qxl.c | |
| parent | 9235c84e0fbbf5c19305e82fc1607393b35b74ef (diff) | |
| download | spice-dfaedec7890069b35f513e4a8ab4071ca54259ff.tar.gz spice-dfaedec7890069b35f513e4a8ab4071ca54259ff.tar.xz spice-dfaedec7890069b35f513e4a8ab4071ca54259ff.zip | |
Fix race condition in red_get_string
Do not read multiple time an array size that can be changed.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Acked-by: Christophe Fergeau <cfergeau@redhat.com>
Diffstat (limited to 'server/red_parse_qxl.c')
| -rw-r--r-- | server/red_parse_qxl.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c index 5656bfb4..d097aa36 100644 --- a/server/red_parse_qxl.c +++ b/server/red_parse_qxl.c @@ -806,6 +806,7 @@ static SpiceString *red_get_string(RedMemSlotInfo *slots, int group_id, size_t chunk_size, qxl_size, red_size, glyph_size; int glyphs, bpp = 0, i; int error; + uint16_t qxl_flags, qxl_length; qxl = (QXLString *)get_virt(slots, addr, sizeof(*qxl), group_id, &error); if (error) { @@ -822,13 +823,15 @@ static SpiceString *red_get_string(RedMemSlotInfo *slots, int group_id, red_put_data_chunks(&chunks); qxl_size = qxl->data_size; + qxl_flags = qxl->flags; + qxl_length = qxl->length; spice_assert(chunk_size == qxl_size); - if (qxl->flags & SPICE_STRING_FLAGS_RASTER_A1) { + if (qxl_flags & SPICE_STRING_FLAGS_RASTER_A1) { bpp = 1; - } else if (qxl->flags & SPICE_STRING_FLAGS_RASTER_A4) { + } else if (qxl_flags & SPICE_STRING_FLAGS_RASTER_A4) { bpp = 4; - } else if (qxl->flags & SPICE_STRING_FLAGS_RASTER_A8) { + } else if (qxl_flags & SPICE_STRING_FLAGS_RASTER_A8) { bpp = 8; } spice_assert(bpp != 0); @@ -845,11 +848,11 @@ static SpiceString *red_get_string(RedMemSlotInfo *slots, int group_id, start = (QXLRasterGlyph*)(&start->data[glyph_size]); } spice_assert(start <= end); - spice_assert(glyphs == qxl->length); + spice_assert(glyphs == qxl_length); red = spice_malloc(red_size); - red->length = qxl->length; - red->flags = qxl->flags; + red->length = qxl_length; + red->flags = qxl_flags; start = (QXLRasterGlyph*)data; end = (QXLRasterGlyph*)(data + chunk_size); |