ui/cursor: make width/height unsigned 16-bit integer
Although not actually exploitable at the moment, a negative width/height could make datasize wrap around and potentially lead to buffer overflow. Since there is no reason a negative width/height is ever appropriate, modify QEMUCursor struct and cursor_alloc prototype to accept uint16_t. This protects us against accidentally introducing future bugs. Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reported-by: Jacek Halon <jacek.halon@gmail.com> Reported-by: Yair Mizrahi <yairh33@gmail.com> Reported-by: Elsayed El-Refa'ei <e.elrefaei99@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20230523163023.608121-1-mcascell@redhat.com>
This commit is contained in:
parent
1dfea3f212
commit
4c93ce54e7
|
@ -144,13 +144,13 @@ typedef struct QemuUIInfo {
|
||||||
|
|
||||||
/* cursor data format is 32bit RGBA */
|
/* cursor data format is 32bit RGBA */
|
||||||
typedef struct QEMUCursor {
|
typedef struct QEMUCursor {
|
||||||
int width, height;
|
uint16_t width, height;
|
||||||
int hot_x, hot_y;
|
int hot_x, hot_y;
|
||||||
int refcount;
|
int refcount;
|
||||||
uint32_t data[];
|
uint32_t data[];
|
||||||
} QEMUCursor;
|
} QEMUCursor;
|
||||||
|
|
||||||
QEMUCursor *cursor_alloc(int width, int height);
|
QEMUCursor *cursor_alloc(uint16_t width, uint16_t height);
|
||||||
QEMUCursor *cursor_ref(QEMUCursor *c);
|
QEMUCursor *cursor_ref(QEMUCursor *c);
|
||||||
void cursor_unref(QEMUCursor *c);
|
void cursor_unref(QEMUCursor *c);
|
||||||
QEMUCursor *cursor_builtin_hidden(void);
|
QEMUCursor *cursor_builtin_hidden(void);
|
||||||
|
|
|
@ -90,11 +90,12 @@ QEMUCursor *cursor_builtin_left_ptr(void)
|
||||||
return cursor_parse_xpm(cursor_left_ptr_xpm);
|
return cursor_parse_xpm(cursor_left_ptr_xpm);
|
||||||
}
|
}
|
||||||
|
|
||||||
QEMUCursor *cursor_alloc(int width, int height)
|
QEMUCursor *cursor_alloc(uint16_t width, uint16_t height)
|
||||||
{
|
{
|
||||||
QEMUCursor *c;
|
QEMUCursor *c;
|
||||||
size_t datasize = width * height * sizeof(uint32_t);
|
size_t datasize = width * height * sizeof(uint32_t);
|
||||||
|
|
||||||
|
/* Modern physical hardware typically uses 512x512 sprites */
|
||||||
if (width > 512 || height > 512) {
|
if (width > 512 || height > 512) {
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue