From c6e484707f28b3e115e64122a0570f6b3c585489 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Tue, 9 Jun 2015 21:08:47 +0200 Subject: [PATCH 1/2] spice-display: fix segfault in qemu_spice_create_update Although it is pretty unusual the stride for the guest image and the mirror image maintained by spice-display can be different. So use separate variables for them. https://bugzilla.redhat.com/show_bug.cgi?id=1163047 Cc: qemu-stable@nongnu.org Reported-by: perrier vincent Signed-off-by: Gerd Hoffmann --- ui/spice-display.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ui/spice-display.c b/ui/spice-display.c index 9c63132054..4e6356a967 100644 --- a/ui/spice-display.c +++ b/ui/spice-display.c @@ -199,7 +199,7 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) static const int blksize = 32; int blocks = (surface_width(ssd->ds) + blksize - 1) / blksize; int dirty_top[blocks]; - int y, yoff, x, xoff, blk, bw; + int y, yoff1, yoff2, x, xoff, blk, bw; int bpp = surface_bytes_per_pixel(ssd->ds); uint8_t *guest, *mirror; @@ -214,13 +214,14 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) guest = surface_data(ssd->ds); mirror = (void *)pixman_image_get_data(ssd->mirror); for (y = ssd->dirty.top; y < ssd->dirty.bottom; y++) { - yoff = y * surface_stride(ssd->ds); + yoff1 = y * surface_stride(ssd->ds); + yoff2 = y * pixman_image_get_stride(ssd->mirror); for (x = ssd->dirty.left; x < ssd->dirty.right; x += blksize) { xoff = x * bpp; blk = x / blksize; bw = MIN(blksize, ssd->dirty.right - x); - if (memcmp(guest + yoff + xoff, - mirror + yoff + xoff, + if (memcmp(guest + yoff1 + xoff, + mirror + yoff2 + xoff, bw * bpp) == 0) { if (dirty_top[blk] != -1) { QXLRect update = { From 5a9259a0b5d6f9424f94539cd9c715b1d166d90c Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Fri, 13 Mar 2015 12:21:50 +0100 Subject: [PATCH 2/2] spice: ui_info tweaks Use the new dpy_ui_info_supported function. Clarifies the control flow. Signed-off-by: Gerd Hoffmann --- ui/spice-display.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/ui/spice-display.c b/ui/spice-display.c index 4e6356a967..cc4a6ce98d 100644 --- a/ui/spice-display.c +++ b/ui/spice-display.c @@ -661,7 +661,10 @@ static int interface_client_monitors_config(QXLInstance *sin, { SimpleSpiceDisplay *ssd = container_of(sin, SimpleSpiceDisplay, qxl); QemuUIInfo info; - int rc; + + if (!dpy_ui_info_supported(ssd->dcl.con)) { + return 0; /* == not supported by guest */ + } if (!mc) { return 1; @@ -676,14 +679,10 @@ static int interface_client_monitors_config(QXLInstance *sin, info.width = mc->monitors[0].width; info.height = mc->monitors[0].height; } - rc = dpy_set_ui_info(ssd->dcl.con, &info); - dprint(1, "%s/%d: size %dx%d, rc %d <--- ==========================\n", - __func__, ssd->qxl.id, info.width, info.height, rc); - if (rc != 0) { - return 0; /* == not supported by guest */ - } else { - return 1; - } + dpy_set_ui_info(ssd->dcl.con, &info); + dprint(1, "%s/%d: size %dx%d\n", __func__, ssd->qxl.id, + info.width, info.height); + return 1; } static const QXLInterface dpy_interface = {