From da35f7f1eeff9f249a9597400fc514c83fd3a0f8 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Mon, 27 May 2019 11:12:26 +0200 Subject: [PATCH] virtio-gpu: add sanity check MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Require a minimum 16x16 size for the scanout, to make sure the guest can't set either width or height to zero. This (a) doesn't make sense at all and (b) causes problems in some UI code. When using spice this will triggers an assert(). Reported-by: Tyler Slabinski Signed-off-by: Gerd Hoffmann Reviewed-by: Marc-André Lureau Message-id: 20190527091226.4943-1-kraxel@redhat.com --- hw/display/virtio-gpu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 9e37e0ac96..372b31ef0a 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -677,6 +677,8 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g, if (ss.r.x > res->width || ss.r.y > res->height || + ss.r.width < 16 || + ss.r.height < 16 || ss.r.width > res->width || ss.r.height > res->height || ss.r.x + ss.r.width > res->width || -- 2.39.2