WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-changelog

[Xen-changelog] [xen-unstable] pvfb: PVFB SDL backend chokes on bogus sc

To: xen-changelog@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-changelog] [xen-unstable] pvfb: PVFB SDL backend chokes on bogus screen updates
From: Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>
Date: Thu, 22 Nov 2007 12:00:15 -0800
Delivery-date: Thu, 22 Nov 2007 12:00:40 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-changelog-request@lists.xensource.com?subject=help>
List-id: BK change log <xen-changelog.lists.xensource.com>
List-post: <mailto:xen-changelog@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=unsubscribe>
Reply-to: xen-devel@xxxxxxxxxxxxxxxxxxx
Sender: xen-changelog-bounces@xxxxxxxxxxxxxxxxxxx
# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1195232023 0
# Node ID 614dad9f8fdcda21b5e0083cce3320b17bfcefdd
# Parent  1ad85cdcca3d99130ce3a74ab3203a3f14c25858
pvfb: PVFB SDL backend chokes on bogus screen updates

Bogus screen update requests from buggy or malicous frontend make SDL
crash.  The VNC backend silently ignores them.  Catch and log them.

Signed-off-by: Markus Armbruster <armbru@xxxxxxxxxx>
---
 tools/ioemu/hw/xenfb.c |   21 ++++++++++++++++++---
 1 files changed, 18 insertions(+), 3 deletions(-)

diff -r 1ad85cdcca3d -r 614dad9f8fdc tools/ioemu/hw/xenfb.c
--- a/tools/ioemu/hw/xenfb.c    Fri Nov 16 16:43:57 2007 +0000
+++ b/tools/ioemu/hw/xenfb.c    Fri Nov 16 16:53:43 2007 +0000
@@ -488,12 +488,27 @@ static void xenfb_on_fb_event(struct xen
        rmb();                  /* ensure we see ring contents up to prod */
        for (cons = page->out_cons; cons != prod; cons++) {
                union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
+               int x, y, w, h;
 
                switch (event->type) {
                case XENFB_TYPE_UPDATE:
-                       xenfb_guest_copy(xenfb,
-                                        event->update.x, event->update.y,
-                                        event->update.width, 
event->update.height);
+                       x = MAX(event->update.x, 0);
+                       y = MAX(event->update.y, 0);
+                       w = MIN(event->update.width, xenfb->width - x);
+                       h = MIN(event->update.height, xenfb->height - y);
+                       if (w < 0 || h < 0) {
+                               fprintf(stderr, "%s bogus update ignored\n",
+                                       xenfb->fb.nodename);
+                               break;
+                       }
+                       if (x != event->update.x || y != event->update.y
+                           || w != event->update.width
+                           || h != event->update.height) {
+                               fprintf(stderr, "%s bogus update clipped\n",
+                                       xenfb->fb.nodename);
+                               break;
+                       }
+                       xenfb_guest_copy(xenfb, x, y, w, h);
                        break;
                }
        }

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog

<Prev in Thread] Current Thread [Next in Thread>
  • [Xen-changelog] [xen-unstable] pvfb: PVFB SDL backend chokes on bogus screen updates, Xen patchbot-unstable <=