-
Roland Dreier authored
Check that the cursor dimensions passed from the guest for the DEFINE_CURSOR command don't overflow the available space in the cursor.image[] or cursor.mask[] arrays before copying data from the guest into those arrays. Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
f2d928d4