Commit 511b13e2 authored by Alon Levy's avatar Alon Levy Committed by Gerd Hoffmann
Browse files

qxl/update_area_io: guest_bug on invalid parameters 



Signed-off-by: default avatarAlon Levy <alevy@redhat.com>
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 27af7788

hw/qxl.c

+12 −0
Original line number Diff line number Diff line
@@ -1386,6 +1386,18 @@ async_common: 
        QXLCookie *cookie = NULL;

        QXLRect update = d->ram->update_area;



        if (d->ram->update_surface > NUM_SURFACES) {

            qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",

                              d->ram->update_surface);

            return;

        }

        if (update.left >= update.right || update.top >= update.bottom) {

            qxl_set_guest_bug(d,

                    "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",

                    update.left, update.top, update.right, update.bottom);

            return;

        }



        if (async == QXL_ASYNC) {

            cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,

                                    QXL_IO_UPDATE_AREA_ASYNC);