virtio-gpu: add sanity check

Require a minimum 16x16 size for the scanout, to make sure the guest
can't set either width or height to zero.  This (a) doesn't make sense
at all and (b) causes problems in some UI code.  When using spice this
will triggers an assert().

Reported-by: Tyler Slabinski <tslabinski@slabity.net>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20190527091226.4943-1-kraxel@redhat.com
This commit is contained in:
Gerd Hoffmann 2019-05-27 11:12:26 +02:00
parent a7b21f6762
commit da35f7f1ee

View File

@ -677,6 +677,8 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
if (ss.r.x > res->width ||
ss.r.y > res->height ||
ss.r.width < 16 ||
ss.r.height < 16 ||
ss.r.width > res->width ||
ss.r.height > res->height ||
ss.r.x + ss.r.width > res->width ||