Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20140902-1' into staging

sanity check for qxl, minor spice display channel tweak.

# gpg: Signature made Tue 02 Sep 2014 09:53:39 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/spice/tags/pull-spice-20140902-1:
  spice: use console index as display id
  qxl-render: add more sanity checks
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

hw/display/qxl-render.c

@@ -138,7 +138,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl)
         if (qemu_spice_rect_is_empty(qxl->dirty+i)) {
             break;
         }
-        if (qxl->dirty[i].left > qxl->dirty[i].right ||
+        if (qxl->dirty[i].left < 0 ||
+            qxl->dirty[i].top < 0 ||
+            qxl->dirty[i].left > qxl->dirty[i].right ||
             qxl->dirty[i].top > qxl->dirty[i].bottom ||
             qxl->dirty[i].right > qxl->guest_primary.surface.width ||
             qxl->dirty[i].bottom > qxl->guest_primary.surface.height) {

ui/spice-core.c

@@ -853,7 +853,6 @@ int qemu_spice_add_interface(SpiceBaseInstance *sin)
 }
 
 static GSList *spice_consoles;
-static int display_id;
 
 bool qemu_spice_have_display_interface(QemuConsole *con)
 {
@@ -868,7 +867,7 @@ int qemu_spice_add_display_interface(QXLInstance *qxlin, QemuConsole *con)
     if (g_slist_find(spice_consoles, con)) {
         return -1;
     }
-    qxlin->id = display_id++;
+    qxlin->id = qemu_console_get_index(con);
     spice_consoles = g_slist_append(spice_consoles, con);
     return qemu_spice_add_interface(&qxlin->base);
 }