"if x or y < 0, set them to 0 (and decrement with/height accordingly)"
If it is possible in this context to have negative x or y, it is also possible to have them larger than width and heigth by absolute value, so that when decrementing width/height accordingly, width/height becomes negative too. There's more: this function does not check for w/h being positive too, just like it doesn't for x/y. And again, if it is possible to have x<0 or y<0 there, it might be just as well possible to have w<0 or h<0 here. And with w<0 or h<0, we'll most likely crash too. So indeed, some (upstream) verification is needed here -- where these negative values are coming from, whenever it is EVER okay to have them, what to do with these, and where to check (I guess the check should be done somewhere in the upper layer). Thanks, /mjt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/918791 Title: qemu-kvm dies when using vmvga driver and unity in the guest To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/918791/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
