Roland Dreier f2d928d44e vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow
Check that the cursor dimensions passed from the guest for the
DEFINE_CURSOR command don't overflow the available space in the
cursor.image[] or cursor.mask[] arrays before copying data from the
guest into those arrays.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2010-01-11 09:56:30 -06:00
..
2009-12-23 16:35:00 +02:00
2009-12-23 16:35:00 +02:00
2010-01-10 18:25:48 +00:00
2009-12-04 20:44:44 +00:00
2009-12-03 09:41:36 -06:00
2009-12-03 09:41:32 -06:00
2009-12-18 11:26:33 -06:00
2009-12-18 11:26:34 -06:00
2009-12-18 11:26:34 -06:00
2009-12-21 15:06:59 +00:00
2009-12-18 11:26:34 -06:00
2009-12-03 09:41:32 -06:00
2009-12-03 09:41:33 -06:00
2009-12-23 16:35:00 +02:00
2009-12-03 09:41:33 -06:00
2009-12-04 20:44:44 +00:00
2009-12-19 16:04:52 +01:00
2010-01-10 20:54:38 +00:00
2009-12-23 16:35:00 +02:00
2009-12-04 20:44:44 +00:00
2009-12-21 16:03:03 +01:00
2009-12-21 16:03:03 +01:00
2009-12-21 16:03:03 +01:00
2009-12-21 16:03:03 +01:00
2009-12-12 07:59:40 -06:00
2009-12-12 07:59:40 -06:00
2009-12-21 20:19:12 +00:00
2009-12-05 17:36:05 +01:00
2009-12-18 16:39:19 +01:00
2009-12-03 09:41:40 -06:00
2009-12-03 09:41:38 -06:00
2009-12-18 23:23:56 +01:00
2009-12-03 09:41:33 -06:00
2009-12-04 20:44:44 +00:00
2009-12-18 23:23:56 +01:00
2009-12-18 23:23:56 +01:00
2009-12-18 11:26:28 -06:00
2009-12-18 11:26:28 -06:00
2009-12-12 07:59:38 -06:00
2009-12-12 07:59:38 -06:00
2009-12-03 09:41:34 -06:00