]> git.proxmox.com Git - qemu.git/commit
projects / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e73223a) | patch
vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow
authorRoland Dreier <rdreier@cisco.com>
Wed, 6 Jan 2010 04:43:34 +0000 (20:43 -0800)
committerAnthony Liguori <aliguori@us.ibm.com>
Mon, 11 Jan 2010 15:56:30 +0000 (09:56 -0600)
commitf2d928d44ebc918750c94f3605c1417f1f653ec9
tree7f1e6940b95b59320d1aea373681f7138be1d985tree
parente73223a5849d9e695b5f3b5a4a2a812e68e3735dcommit | diff
vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow

Check that the cursor dimensions passed from the guest for the
DEFINE_CURSOR command don't overflow the available space in the
cursor.image[] or cursor.mask[] arrays before copying data from the
guest into those arrays.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
hw/vmware_vga.c diff | blob | blame | history
Qemu copy for testing