[PATCH spice-server] Avoid integer overflow for Drawable::refs field

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This fixes a regression caused by
a43c21b6bcdda701763afb6d73e38a3c419e54c7
("DCC: change how fill_bits() marshalls data by reference").
Before the mentioned patch the number of references to Drawable
structure were really few so an uint8_t was enough.
Now that every chunk of the image are accounted you can easily
get an overflow.
This fixes https://bugs.freedesktop.org/show_bug.cgi?id=99258.

Signed-off-by: Frediano Ziglio <fziglio@xxxxxxxxxx>
---
 server/display-channel.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/display-channel.h b/server/display-channel.h
index 715ad1a..5ecc5c3 100644
--- a/server/display-channel.h
+++ b/server/display-channel.h
@@ -81,7 +81,7 @@ typedef struct DependItem {
 } DependItem;
 
 struct Drawable {
-    uint8_t refs;
+    uint32_t refs;
     RingItem surface_list_link;
     RingItem list_link;
     DrawItem tree_item;
-- 
2.9.3

_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel




[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]     [Monitors]