From: Marc-André Lureau <[email protected]>

"rows" was already computed in an earlier commit 3543c2b855 ("ui/vnc:
fix OOB write in vnc_refresh_lossy_rect").
(Mjt: in 10.0.x this is commit 5ab666fda9d)

Fixes: e650e4fe0f ("ui/vnc: fix out-of-bounds write in lossy refresh dirty 
marking")
Reviewed-by: Daniel P. Berrangé <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
(cherry picked from commit efa7244b2a0bd5e40ec334dbec4a09af0134d91f)
Signed-off-by: Michael Tokarev <[email protected]>

diff --git a/ui/vnc.c b/ui/vnc.c
index 8be69754e0e..ac03d42b32b 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -3005,7 +3005,6 @@ static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, 
int y,
 
     y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
     x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
-    rows = MIN(VNC_STAT_RECT, height - y);
 
     rows = MIN(VNC_STAT_RECT, height - y);
     if (rows <= 0) {
-- 
2.47.3


Reply via email to