mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2024-12-08 22:02:44 +03:00
ui/cursor: make width/height unsigned 16-bit integer
Although not actually exploitable at the moment, a negative width/height could make datasize wrap around and potentially lead to buffer overflow. Since there is no reason a negative width/height is ever appropriate, modify QEMUCursor struct and cursor_alloc prototype to accept uint16_t. This protects us against accidentally introducing future bugs. Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reported-by: Jacek Halon <jacek.halon@gmail.com> Reported-by: Yair Mizrahi <yairh33@gmail.com> Reported-by: Elsayed El-Refa'ei <e.elrefaei99@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20230523163023.608121-1-mcascell@redhat.com>
This commit is contained in:
parent
1dfea3f212
commit
4c93ce54e7
@ -144,13 +144,13 @@ typedef struct QemuUIInfo {
|
||||
|
||||
/* cursor data format is 32bit RGBA */
|
||||
typedef struct QEMUCursor {
|
||||
int width, height;
|
||||
uint16_t width, height;
|
||||
int hot_x, hot_y;
|
||||
int refcount;
|
||||
uint32_t data[];
|
||||
} QEMUCursor;
|
||||
|
||||
QEMUCursor *cursor_alloc(int width, int height);
|
||||
QEMUCursor *cursor_alloc(uint16_t width, uint16_t height);
|
||||
QEMUCursor *cursor_ref(QEMUCursor *c);
|
||||
void cursor_unref(QEMUCursor *c);
|
||||
QEMUCursor *cursor_builtin_hidden(void);
|
||||
|
@ -90,11 +90,12 @@ QEMUCursor *cursor_builtin_left_ptr(void)
|
||||
return cursor_parse_xpm(cursor_left_ptr_xpm);
|
||||
}
|
||||
|
||||
QEMUCursor *cursor_alloc(int width, int height)
|
||||
QEMUCursor *cursor_alloc(uint16_t width, uint16_t height)
|
||||
{
|
||||
QEMUCursor *c;
|
||||
size_t datasize = width * height * sizeof(uint32_t);
|
||||
|
||||
/* Modern physical hardware typically uses 512x512 sprites */
|
||||
if (width > 512 || height > 512) {
|
||||
return NULL;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user