Signed-off-by: Frediano Ziglio <fziglio@xxxxxxxxxx>
---
server/display-channel.c | 2 ++
1 file changed, 2 insertions(+)
Changes since v1:
- improved comment
diff --git a/server/display-channel.c b/server/display-channel.c
index 8b949a2..a85c091 100644
--- a/server/display-channel.c
+++ b/server/display-channel.c
@@ -1985,6 +1985,8 @@ void display_channel_process_surface_cmd(DisplayChannel *display, RedSurfaceCmd
}
data = surface->u.surface_create.data;
if (stride < 0) {
+ /* no worry for overflow here, command should already be validated
+ * when is readed, specifically red_get_surface_cmd */
data -= (int32_t)(stride * (height - 1));
}
display_channel_create_surface(display, surface_id, surface->u.surface_create.width,
--
2.7.4
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel