dev-zero 14/08/10 13:06:49
Added:
spice-0.12.5-fix-crash-when-clearing-surface-memory.patch
spice-0.12.5-server-dont-assert-on-invalid-client-message.patch
Log:
Rev.bump to pull in media-libs/opus to avoid automagic dep (bug #518546).
Pull more patches from upstream.
(Portage version: 2.2.10/cvs/Linux x86_64, signed Manifest commit with key
0x1A5D023975B0583D!)
Revision Changes Path
1.1
app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch?rev=1.1&content-type=text/plain
Index: spice-0.12.5-fix-crash-when-clearing-surface-memory.patch
===================================================================
>From 1898f3949cf75422aa1fedba40c429b28d8d6b67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <[email protected]>
Date: Wed, 6 Aug 2014 18:34:56 +0200
Subject: Fix crash when clearing surface memory
The beginning of the surface data needs to be computed correctly if the
stride is negative, otherwise, it should point already to the beginning
of the surface data. This bug seems to exists since 4a208b (0.5.2)
https://bugzilla.redhat.com/show_bug.cgi?id=1029646
diff --git a/server/red_worker.c b/server/red_worker.c
index 6bdad93..35a1a04 100644
--- a/server/red_worker.c
+++ b/server/red_worker.c
@@ -9470,7 +9470,11 @@ static inline void red_create_surface(RedWorker *worker,
uint32_t surface_id, ui
surface->context.stride = stride;
surface->context.line_0 = line_0;
if (!data_is_valid) {
- memset((char *)line_0 + (int32_t)(stride * (height - 1)), 0,
height*abs(stride));
+ char *data = line_0;
+ if (stride < 0) {
+ data -= abs(stride) * (height - 1);
+ }
+ memset(data, 0, height*abs(stride));
}
surface->create.info = NULL;
surface->destroy.info = NULL;
--
cgit v0.10.2
1.1
app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch?rev=1.1&content-type=text/plain
Index: spice-0.12.5-server-dont-assert-on-invalid-client-message.patch
===================================================================
>From 3c25192ee90f843a2f84ff99d119b1cb45979bac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <[email protected]>
Date: Wed, 25 Jun 2014 14:36:03 +0200
Subject: server: don't assert on invalid client message
Some users have been reaching this error:
snd_receive: ASSERT n failed
A misbehaving client could easily hit that condition by sending too big
messages. Instead of assert(), replace with a warning. When a message
too big to fit is received, it will simply disconnect the channel.
https://bugzilla.redhat.com/show_bug.cgi?id=962187
diff --git a/server/snd_worker.c b/server/snd_worker.c
index 7d52ded..70148b7 100644
--- a/server/snd_worker.c
+++ b/server/snd_worker.c
@@ -421,7 +421,7 @@ static void snd_receive(void* data)
for (;;) {
ssize_t n;
n = channel->receive_data.end - channel->receive_data.now;
- spice_assert(n);
+ spice_warn_if(n <= 0);
n = reds_stream_read(channel->stream, channel->receive_data.now, n);
if (n <= 0) {
if (n == 0) {
--
cgit v0.10.2
