• S
    vnc: Fix stack corruption and other bitmap related bugs · 23bfe28f
    Stefan Weil 提交于
    Commit bc2429b9 introduced
    a severe bug (stack corruption).
    
    bitmap_clear was called with a wrong argument
    which caused out-of-bound writes to the local variable width_mask.
    
    This bug was detected with QEMU running on windows.
    It also occurs with wine:
    
    *** stack smashing detected ***:  terminated
    wine: Unhandled illegal instruction at address 0x6115c7 (thread 0009), starting debugger...
    
    The bug is not windows specific!
    
    Instead of fixing the wrong parameter value, bitmap_clear(), bitmap_set
    and width_mask were removed, and bitmap_intersect() was replaced by
    !bitmap_empty(). The new operation is much shorter and equivalent to
    the old operations.
    
    The declarations of the dirty bitmaps in vnc.h were also wrong for 64 bit
    hosts because of a rounding effect: for these hosts, VNC_MAX_WIDTH is no
    longer a multiple of (16 * BITS_PER_LONG), so the rounded value of
    VNC_DIRTY_WORDS was too small.
    
    Fix both declarations by using the macro which is designed for this
    purpose.
    
    Cc: Corentin Chary <corentincj@iksaif.net>
    Cc: Wen Congyang <wency@cn.fujitsu.com>
    Cc: Gerhard Wiesinger <lists@wiesinger.com>
    Cc: Anthony Liguori <aliguori@us.ibm.com>
    Signed-off-by: NStefan Weil <weil@mail.berlios.de>
    Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
    23bfe28f
vnc.h 16.3 KB