File 0016-Make-sure-we-can-read-QXLPathSeg-structure... of Package spice.1097

Overview Repositories Revisions Requests Users Attributes Meta

File 0016-Make-sure-we-can-read-QXLPathSeg-structures.patch of Package spice.1097

From 2693e0497e5626642250cff47a59b3b4b2cd432d Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <fziglio@redhat.com>
Date: Tue, 15 Sep 2015 16:25:17 +0100
Subject: [PATCH 16/19] Make sure we can read QXLPathSeg structures

start pointer points to a QXLPathSeg structure.
Before reading from the structure, make sure the structure is contained
in the memory range checked.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Acked-by: Christophe Fergeau <cfergeau@redhat.com>
---
 server/red_parse_qxl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c
index f21bfa5..281faad 100644
--- a/server/red_parse_qxl.c
+++ b/server/red_parse_qxl.c
@@ -256,7 +256,7 @@ static SpicePath *red_get_path(RedMemSlotInfo *slots, int group_id,
 
     start = (QXLPathSeg*)data;
     end = (QXLPathSeg*)(data + size);
-    while (start < end) {
+    while (start+1 < end) {
         n_segments++;
         count = start->count;
         segment_size = sizeof(SpicePathSeg) + count * sizeof(SpicePointFix);
@@ -272,7 +272,7 @@ static SpicePath *red_get_path(RedMemSlotInfo *slots, int group_id,
     seg = (SpicePathSeg*)&red->segments[n_segments];
     n_segments = 0;
     mem_size2 = sizeof(*red);
-    while (start < end) {
+    while (start+1 < end) {
         red->segments[n_segments++] = seg;
         count = start->count;
 
-- 
2.1.4

Places

File 0016-Make-sure-we-can-read-QXLPathSeg-structures.patch of Package spice.1097

Places