an often reported use after free crash (rhbz#873845) - Replace "wip: hw/qxl: inject interrupts in any state" patch with the official upstream fix - Add 5 other spice/qxl crash/bug fixes cherry-picked from upstream
42 lines
1.6 KiB
Diff
42 lines
1.6 KiB
Diff
From 39a4efbef72744cb09151954091710400c31f18d Mon Sep 17 00:00:00 2001
|
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Mon, 10 Dec 2012 07:41:07 +0100
|
|
Subject: [PATCH 521/564] qxl: save qemu_create_displaysurface_from result
|
|
|
|
Spotted by Coverity.
|
|
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=885644
|
|
|
|
Cc: qemu-stable@nongnu.org
|
|
Reported-by: Markus Armbruster <armbru@redhat.com>
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
---
|
|
hw/qxl-render.c | 11 ++++++-----
|
|
1 file changed, 6 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/hw/qxl-render.c b/hw/qxl-render.c
|
|
index b66c168..e7d41ec 100644
|
|
--- a/hw/qxl-render.c
|
|
+++ b/hw/qxl-render.c
|
|
@@ -113,11 +113,12 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl)
|
|
qxl->guest_primary.bits_pp);
|
|
if (qxl->guest_primary.qxl_stride > 0) {
|
|
qemu_free_displaysurface(vga->ds);
|
|
- qemu_create_displaysurface_from(qxl->guest_primary.surface.width,
|
|
- qxl->guest_primary.surface.height,
|
|
- qxl->guest_primary.bits_pp,
|
|
- qxl->guest_primary.abs_stride,
|
|
- qxl->guest_primary.data);
|
|
+ vga->ds->surface = qemu_create_displaysurface_from
|
|
+ (qxl->guest_primary.surface.width,
|
|
+ qxl->guest_primary.surface.height,
|
|
+ qxl->guest_primary.bits_pp,
|
|
+ qxl->guest_primary.abs_stride,
|
|
+ qxl->guest_primary.data);
|
|
} else {
|
|
qemu_resize_displaysurface(vga->ds,
|
|
qxl->guest_primary.surface.width,
|
|
--
|
|
1.8.1
|
|
|