[Xen-devel] Two small patches related to xenfb

[Rafal Wojtczuk <rafal@xxxxxxxxxxxxxxxxxxxxxx>]

Hello,
Two minor issues:
row_stride_div0.patch: a malicious frontend can send row_stride==0 and force
qemu-dm to perform division by 0
vnc_resize_doublecheck.patch: there is an unchecked multiplication when
calculating framebuffer size. Cs 17630 sanitizes framebuffer dimensions
passed by the frontend, so most probably no integer overflow can happen, but
there should be a check for overflow close to the actual computation (to
make code review easier and to cope with other codepaths in the future). 

Diffs against xen-3.2-testing.hg.

Regards,
Rafal Wojtczuk
Principal Researcher
Invisible Things Lab

Attachment: row_stride_div0.patch
Description: Text document

Attachment: vnc_resize_doublecheck.patch
Description: Text document

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel