Re: [Qemu-devel] [PATCH] vnc: Fix heap corruption

[Wen Congyang]

At 03/01/2011 05:34 AM, Stefan Weil Write:
> Commit bc2429b9174ac2d3c56b7fd35884b0d89ec7fb02 introduced
> a severe bug (heap corruption).
> 
> bitmap_clear was called with a wrong argument
> which caused out-of-bound writes to width_mask.
> 
> This bug was detected with QEMU running on windows.
> It also occurs with wine:
> 
> *** stack smashing detected ***:  terminated
> wine: Unhandled illegal instruction at address 0x6115c7 (thread 0009), 
> starting debugger...
> 
> The bug is not windows specific!
> 
> Cc: Corentin Chary <corenti...@iksaif.net>
> Cc: Anthony Liguori <aligu...@us.ibm.com>
> Signed-off-by: Stefan Weil <w...@mail.berlios.de>
> ---
>  ui/vnc.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/ui/vnc.c b/ui/vnc.c
> index af55156..89f71da 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -2401,7 +2401,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
>       */
>      bitmap_set(width_mask, 0, (ds_get_width(vd->ds) / 16));
>      bitmap_clear(width_mask, (ds_get_width(vd->ds) / 16),
> -                 VNC_DIRTY_WORDS * BITS_PER_LONG);
> +                 (VNC_MAX_WIDTH - ds_get_width(vd->ds)) / 16);

The third argument of bitmap_clear() is number of bits to be cleared, but we 
pass
the end bits to be cleared to bitmap_clear().

I think we can fix this bug like this(I can not reproduce this bug, so I do not
know whether it can fix this bug):

diff --git a/ui/vnc.c b/ui/vnc.c
index fff34af..6d54661 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2404,7 +2404,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
      */
     bitmap_set(width_mask, 0, (ds_get_width(vd->ds) / 16));
     bitmap_clear(width_mask, (ds_get_width(vd->ds) / 16),
-                 VNC_DIRTY_WORDS * BITS_PER_LONG);
+                 VNC_DIRTY_WORDS * BITS_PER_LONG - (ds_get_width(vd->ds) / 
16));
     cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
     guest_row  = vd->guest.ds->data;
     server_row = vd->server->data;

Thanks
Wen Congyang

>      cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
>      guest_row  = vd->guest.ds->data;
>      server_row = vd->server->data;