Commit a89d97df authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/spice/tags/pull-spice-3' into staging 



qxl: add sanity check

# gpg: Signature made Mon 24 Feb 2014 12:01:27 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/spice/tags/pull-spice-3:
  qxl: add sanity check

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents 0459650d 9c70434f

hw/display/qxl.c

+7 −1
Original line number Diff line number Diff line
@@ -1429,7 +1429,7 @@ static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async) 
    return 1;

}



static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)

static void qxl_set_mode(PCIQXLDevice *d, unsigned int modenr, int loadvm)

{

    pcibus_t start = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;

    pcibus_t end   = d->pci.io_regions[QXL_RAM_RANGE_INDEX].size + start;
@@ -1439,6 +1439,12 @@ static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm) 
        .mem_start = start,

        .mem_end = end

    };



    if (modenr >= d->modes->n_modes) {

        qxl_set_guest_bug(d, "mode number out of range");

        return;

    }



    QXLSurfaceCreate surface = {

        .width      = mode->x_res,

        .height     = mode->y_res,