From 60b8fd160f640b0cdc24f310378ff987e344fa4e Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 28 Feb 2013 17:16:48 +0100
Subject: [PATCH] vnc: stop using DisplayState

Rework DisplayStateListener callbacks to not use the DisplayState
any more.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit d39fa6d86d07646e3481e5c3e45a984bff590642)
[BR: BSC#1026612 CVE-2017-2633 (infrastructure patch)]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 ui/vnc-enc-tight.c |  7 ++---
 ui/vnc-jobs.c      |  1 -
 ui/vnc.c           | 75 ++++++++++++++++++++++++++++++------------------------
 ui/vnc.h           |  3 +--
 4 files changed, 47 insertions(+), 39 deletions(-)

diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index 4ddea7d4f5..e6966aebc3 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -123,7 +123,7 @@ static bool tight_can_send_png_rect(VncState *vs, int w, int h)
         return false;
     }
 
-    if (ds_get_bytes_per_pixel(vs->ds) == 1 ||
+    if (surface_bytes_per_pixel(vs->vd->ds) == 1 ||
         vs->client_pf.bytes_per_pixel == 1) {
         return false;
     }
@@ -301,7 +301,7 @@ tight_detect_smooth_image(VncState *vs, int w, int h)
         return 0;
     }
 
-    if (ds_get_bytes_per_pixel(vs->ds) == 1 ||
+    if (surface_bytes_per_pixel(vs->vd->ds) == 1 ||
         vs->client_pf.bytes_per_pixel == 1 ||
         w < VNC_TIGHT_DETECT_MIN_WIDTH || h < VNC_TIGHT_DETECT_MIN_HEIGHT) {
         return 0;
@@ -1184,8 +1184,9 @@ static int send_jpeg_rect(VncState *vs, int x, int y, int w, int h, int quality)
     uint8_t *buf;
     int dy;
 
-    if (ds_get_bytes_per_pixel(vs->ds) == 1)
+    if (surface_bytes_per_pixel(vs->vd->ds) == 1) {
         return send_full_color_rect(vs, x, y, w, h);
+    }
 
     buffer_reserve(&vs->tight.jpeg, 2048);
 
diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c
index 0bfc0c5485..2d3fce8155 100644
--- a/ui/vnc-jobs.c
+++ b/ui/vnc-jobs.c
@@ -183,7 +183,6 @@ static void vnc_async_encoding_start(VncState *orig, VncState *local)
 {
     local->vnc_encoding = orig->vnc_encoding;
     local->features = orig->features;
-    local->ds = orig->ds;
     local->vd = orig->vd;
     local->lossy_rect = orig->lossy_rect;
     local->write_pixels = orig->write_pixels;
diff --git a/ui/vnc.c b/ui/vnc.c
index f3e842e022..60132643dd 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -436,8 +436,8 @@ static void vnc_dpy_update(DisplayChangeListener *dcl,
     int i;
     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
     struct VncSurface *s = &vd->guest;
-    int width = ds_get_width(ds);
-    int height = ds_get_height(ds);
+    int width = surface_width(vd->ds);
+    int height = surface_height(vd->ds);
 
     h += y;
 
@@ -519,17 +519,17 @@ void buffer_advance(Buffer *buf, size_t len)
 
 static void vnc_desktop_resize(VncState *vs)
 {
-    DisplayState *ds = vs->ds;
+    DisplaySurface *ds = vs->vd->ds;
 
     if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
         return;
     }
-    if (vs->client_width == ds_get_width(ds) &&
-        vs->client_height == ds_get_height(ds)) {
+    if (vs->client_width == surface_width(ds) &&
+        vs->client_height == surface_height(ds)) {
         return;
     }
-    vs->client_width = ds_get_width(ds);
-    vs->client_height = ds_get_height(ds);
+    vs->client_width = surface_width(ds);
+    vs->client_height = surface_height(ds);
     vnc_lock_output(vs);
     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
     vnc_write_u8(vs, 0);
@@ -575,7 +575,7 @@ void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
 }
 
 static void vnc_dpy_switch(DisplayChangeListener *dcl,
-                           DisplayState *ds,
+                           DisplayState *dontuse,
                            DisplaySurface *surface)
 {
     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
@@ -585,9 +585,10 @@ static void vnc_dpy_switch(DisplayChangeListener *dcl,
 
     /* server surface */
     qemu_pixman_image_unref(vd->server);
+    vd->ds = surface;
     vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
-                                          ds_get_width(ds),
-                                          ds_get_height(ds),
+                                          surface_width(vd->ds),
+                                          surface_height(vd->ds),
                                           NULL, 0);
 
     /* guest surface */
@@ -596,8 +597,8 @@ static void vnc_dpy_switch(DisplayChangeListener *dcl,
         console_color_init(ds);
 #endif
     qemu_pixman_image_unref(vd->guest.fb);
-    vd->guest.fb = pixman_image_ref(ds->surface->image);
-    vd->guest.format = ds->surface->format;
+    vd->guest.fb = pixman_image_ref(surface->image);
+    vd->guest.format = surface->format;
     memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
 
     QTAILQ_FOREACH(vs, &vd->clients, next) {
@@ -725,7 +726,7 @@ int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
 }
 
 static void vnc_mouse_set(DisplayChangeListener *dcl,
-                          DisplayState *ds,
+                          DisplayState *dontuse,
                           int x, int y, int visible)
 {
     /* can we ask the client(s) to move the pointer ??? */
@@ -753,7 +754,7 @@ static int vnc_cursor_define(VncState *vs)
 }
 
 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
-                                  DisplayState *ds,
+                                  DisplayState *dontuse,
                                   QEMUCursor *c)
 {
     VncDisplay *vd = vnc_display;
@@ -1415,7 +1416,8 @@ static void check_pointer_type_change(Notifier *notifier, void *data)
         vnc_write_u8(vs, 0);
         vnc_write_u16(vs, 1);
         vnc_framebuffer_update(vs, absolute, 0,
-                               ds_get_width(vs->ds), ds_get_height(vs->ds),
+                               surface_width(vs->vd->ds),
+                               surface_height(vs->vd->ds),
                                VNC_ENCODING_POINTER_TYPE_CHANGE);
         vnc_unlock_output(vs);
         vnc_flush(vs);
@@ -1427,6 +1429,8 @@ static void pointer_event(VncState *vs, int button_mask, int x, int y)
 {
     int buttons = 0;
     int dz = 0;
+    int width = surface_width(vs->vd->ds);
+    int height = surface_height(vs->vd->ds);
 
     if (button_mask & 0x01)
         buttons |= MOUSE_EVENT_LBUTTON;
@@ -1440,10 +1444,8 @@ static void pointer_event(VncState *vs, int button_mask, int x, int y)
         dz = 1;
 
     if (vs->absolute) {
-        kbd_mouse_event(ds_get_width(vs->ds) > 1 ?
-                          x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000,
-                        ds_get_height(vs->ds) > 1 ?
-                          y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000,
+        kbd_mouse_event(width  > 1 ? x * 0x7FFF / (width  - 1) : 0x4000,
+                        height > 1 ? y * 0x7FFF / (height - 1) : 0x4000,
                         dz, buttons);
     } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
         x -= 0x7FFF;
@@ -1733,12 +1735,15 @@ static void framebuffer_update_request(VncState *vs, int incremental,
                                        int w, int h)
 {
     int i;
-    const size_t width = ds_get_width(vs->ds) / 16;
+    const size_t width = surface_width(vs->vd->ds) / 16;
+    const size_t height = surface_height(vs->vd->ds);
 
-    if (y_position > ds_get_height(vs->ds))
-        y_position = ds_get_height(vs->ds);
-    if (y_position + h >= ds_get_height(vs->ds))
-        h = ds_get_height(vs->ds) - y_position;
+    if (y_position > height) {
+        y_position = height;
+    }
+    if (y_position + h >= height) {
+        h = height - y_position;
+    }
 
     vs->need_update = 1;
     if (!incremental) {
@@ -1757,7 +1762,9 @@ static void send_ext_key_event_ack(VncState *vs)
     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
     vnc_write_u8(vs, 0);
     vnc_write_u16(vs, 1);
-    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
+    vnc_framebuffer_update(vs, 0, 0,
+                           surface_width(vs->vd->ds),
+                           surface_height(vs->vd->ds),
                            VNC_ENCODING_EXT_KEY_EVENT);
     vnc_unlock_output(vs);
     vnc_flush(vs);
@@ -1769,7 +1776,9 @@ static void send_ext_audio_ack(VncState *vs)
     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
     vnc_write_u8(vs, 0);
     vnc_write_u16(vs, 1);
-    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
+    vnc_framebuffer_update(vs, 0, 0,
+                           surface_width(vs->vd->ds),
+                           surface_height(vs->vd->ds),
                            VNC_ENCODING_AUDIO);
     vnc_unlock_output(vs);
     vnc_flush(vs);
@@ -1981,8 +1990,10 @@ static void vnc_colordepth(VncState *vs)
         vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
         vnc_write_u8(vs, 0);
         vnc_write_u16(vs, 1); /* number of rects */
-        vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), 
-                               ds_get_height(vs->ds), VNC_ENCODING_WMVi);
+        vnc_framebuffer_update(vs, 0, 0,
+                               surface_width(vs->vd->ds),
+                               surface_height(vs->vd->ds),
+                               VNC_ENCODING_WMVi);
         pixel_format_message(vs);
         vnc_unlock_output(vs);
         vnc_flush(vs);
@@ -2205,8 +2216,8 @@ static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
     }
     vnc_set_share_mode(vs, mode);
 
-    vs->client_width = ds_get_width(vs->ds);
-    vs->client_height = ds_get_height(vs->ds);
+    vs->client_width = surface_width(vs->vd->ds);
+    vs->client_height = surface_height(vs->vd->ds);
     vnc_write_u16(vs, vs->client_width);
     vnc_write_u16(vs, vs->client_height);
 
@@ -2684,7 +2695,7 @@ static void vnc_init_timer(VncDisplay *vd)
     vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
     if (vd->timer == NULL && !QTAILQ_EMPTY(&vd->clients)) {
         vd->timer = qemu_new_timer_ms(rt_clock, vnc_refresh, vd);
-        vnc_dpy_switch(&vd->dcl, vd->ds, vd->ds->surface);
+        vga_hw_update();
         vnc_refresh(vd);
     }
 }
@@ -2763,7 +2774,6 @@ void vnc_init_state(VncState *vs)
     vs->initialized = true;
     VncDisplay *vd = vs->vd;
 
-    vs->ds = vd->ds;
     vs->last_x = -1;
     vs->last_y = -1;
 
@@ -2849,7 +2859,6 @@ void vnc_display_init(DisplayState *ds)
     vs->lwebsock = -1;
 #endif
 
-    vs->ds = ds;
     QTAILQ_INIT(&vs->clients);
     vs->expires = TIME_MAX;
 
diff --git a/ui/vnc.h b/ui/vnc.h
index 2d08bee05c..0fc4ad3696 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -150,7 +150,7 @@ struct VncDisplay
     bool websocket;
     char *ws_display;
 #endif
-    DisplayState *ds;
+    DisplaySurface *ds;
     DisplayChangeListener dcl;
     kbd_layout_t *kbd_layout;
     int lock_key_sync;
@@ -248,7 +248,6 @@ struct VncState
 {
     int csock;
 
-    DisplayState *ds;
     DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], VNC_DIRTY_BITS);
     uint8_t **lossy_rect; /* Not an Array to avoid costly memcpy in
                            * vnc-jobs-async.c */
