• P
    ui/vnc: fix potential memory corruption issues · bea60dd7
    Peter Lieven 提交于
    this patch makes the VNC server work correctly if the
    server surface and the guest surface have different sizes.
    
    Basically the server surface is adjusted to not exceed VNC_MAX_WIDTH
    x VNC_MAX_HEIGHT and additionally the width is rounded up to multiple of
    VNC_DIRTY_PIXELS_PER_BIT.
    
    If we have a resolution whose width is not dividable by VNC_DIRTY_PIXELS_PER_BIT
    we now get a small black bar on the right of the screen.
    
    If the surface is too big to fit the limits only the upper left area is shown.
    
    On top of that this fixes 2 memory corruption issues:
    
    The first was actually discovered during playing
    around with a Windows 7 vServer. During resolution
    change in Windows 7 it happens sometimes that Windows
    changes to an intermediate resolution where
    server_stride % cmp_bytes != 0 (in vnc_refresh_server_surface).
    This happens only if width % VNC_DIRTY_PIXELS_PER_BIT != 0.
    
    The second is a theoretical issue, but is maybe exploitable
    by the guest. If for some reason the guest surface size is bigger
    than VNC_MAX_WIDTH x VNC_MAX_HEIGHT we end up in severe corruption since
    this limit is nowhere enforced.
    Signed-off-by: NPeter Lieven <pl@kamp.de>
    Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
    bea60dd7
vnc.c 97.5 KB