--- server/red_parse_qxl.c | 9 +++++++++ server/red_worker.c | 4 ++++ 2 files changed, 13 insertions(+) diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c index e6c2705..daae897 100644 --- a/server/red_parse_qxl.c +++ b/server/red_parse_qxl.c @@ -328,6 +328,10 @@ static SpiceChunks *red_get_image_data_chunked(RedMemSlotInfo *slots, int group_ return data; } +// This is based on SPICE_BITMAP_FMT_*, copied from server/red_worker.c +// to avoid a possible unoptimization from making it non static. +static const int BITMAP_FMT_IS_RGB[] = {0, 0, 0, 0, 0, 0, 1, 1, 1, 1}; + static SpiceImage *red_get_image(RedMemSlotInfo *slots, int group_id, QXLPHYSICAL addr, uint32_t flags) { @@ -362,6 +366,11 @@ static SpiceImage *red_get_image(RedMemSlotInfo *slots, int group_id, switch (red->descriptor.type) { case SPICE_IMAGE_TYPE_BITMAP: red->u.bitmap.format = qxl->bitmap.format; + if (!bitmap_fmt_is_rgb(qxl->bitmap.format) && !qxl->bitmap.palette) { + spice_warning("guest error: missing palette on bitmap format=%d\n", + red->u.bitmap.format); + return NULL; + } qxl_flags = qxl->bitmap.flags; if (qxl_flags & QXL_BITMAP_TOP_DOWN) { red->u.bitmap.flags = SPICE_BITMAP_FLAGS_TOP_DOWN; diff --git a/server/red_worker.c b/server/red_worker.c index 71df5a1..5634db5 100644 --- a/server/red_worker.c +++ b/server/red_worker.c @@ -6014,6 +6014,10 @@ static inline int red_lz_compress_image(DisplayChannelClient *dcc, o_comp_data->comp_buf = lz_data->data.bufs_head; o_comp_data->comp_buf_size = size; } else { + if (!src->palette) { + spice_warning("bad guest: missing palette\n"); + return FALSE; + } dest->descriptor.type = SPICE_IMAGE_TYPE_LZ_PLT; dest->u.lz_plt.data_size = size; dest->u.lz_plt.flags = src->flags & SPICE_BITMAP_FLAGS_TOP_DOWN; -- 1.7.10.1 _______________________________________________ Spice-devel mailing list Spice-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/spice-devel