commit 08688af04dc1137ac2f420b35c235183926b4a23
author Markus Armbruster <armbru@redhat.com> Thu Jan 10 14:24:50 2013 +0100
committer Gerd Hoffmann <kraxel@redhat.com> Mon Jan 14 08:59:38 2013 +0100
tree c69d3e3b9e8d1ab7a5e0f394c4d91ec51babb03c
parent bc5f92e5db6f303e73387278e32f8669f0abf0e5

qxl: Don't drop client capability bits

interface_set_client_capabilities() copies only the first few bits,
because it falls into a Classic C trap: you can declare a parameter
uint8_t caps[58], but the resulting parameter type is uint8_t *, not
uint8_t[58].  In particular, sizeof(caps) is sizeof(uint8_t *), not
the intended sizeof(uint8_t[58]).

Harmless, because the bits aren't used, yet.  Broken in commit
c10018d6.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

hw/qxl.c

diff --git a/hw/qxl.c b/hw/qxl.c
index e8f380b..9dc44b9 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -951,9 +951,11 @@
     }
 
     qxl->shadow_rom.client_present = client_present;
-    memcpy(qxl->shadow_rom.client_capabilities, caps, sizeof(caps));
+    memcpy(qxl->shadow_rom.client_capabilities, caps,
+           sizeof(qxl->shadow_rom.client_capabilities));
     qxl->rom->client_present = client_present;
-    memcpy(qxl->rom->client_capabilities, caps, sizeof(caps));
+    memcpy(qxl->rom->client_capabilities, caps,
+           sizeof(qxl->rom->client_capabilities));
     qxl_rom_set_dirty(qxl);
 
     qxl_send_events(qxl, QXL_INTERRUPT_CLIENT);