[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 1/4] sm501: Fix bounds checks
From: |
Gerd Hoffmann |
Subject: |
[PULL 1/4] sm501: Fix bounds checks |
Date: |
Mon, 15 Jun 2020 17:14:46 +0200 |
From: BALATON Zoltan <balaton@eik.bme.hu>
We don't need to add width to pitch when calculating last point, that
would reject valid ops within the card's local_mem.
Fixes: b15a22bbcbe6a78dc3d88fe3134985e4cdd87de4
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-id:
acb431de2d9c7a497d54a548dfc7592eb2b9fe1c.1591471056.git.balaton@eik.bme.hu
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
hw/display/sm501.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index edd8d24a76c1..5ae320ddc325 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -723,8 +723,8 @@ static void sm501_2d_operation(SM501State *s)
dst_y -= height - 1;
}
- if (dst_base >= get_local_mem_size(s) || dst_base +
- (dst_x + width + (dst_y + height) * (dst_pitch + width)) *
+ if (dst_base >= get_local_mem_size(s) ||
+ dst_base + (dst_x + width + (dst_y + height) * dst_pitch) *
(1 << format) >= get_local_mem_size(s)) {
qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n");
return;
@@ -749,8 +749,8 @@ static void sm501_2d_operation(SM501State *s)
src_y -= height - 1;
}
- if (src_base >= get_local_mem_size(s) || src_base +
- (src_x + width + (src_y + height) * (src_pitch + width)) *
+ if (src_base >= get_local_mem_size(s) ||
+ src_base + (src_x + width + (src_y + height) * src_pitch) *
(1 << format) >= get_local_mem_size(s)) {
qemu_log_mask(LOG_GUEST_ERROR,
"sm501: 2D op src is outside vram.\n");
--
2.18.4
- [PULL 0/4] Vga 20200615 patches, Gerd Hoffmann, 2020/06/15
- [PULL 2/4] sm501: Drop unneded variable, Gerd Hoffmann, 2020/06/15
- [PULL 3/4] sm501: Ignore no-op blits, Gerd Hoffmann, 2020/06/15
- [PULL 4/4] sm501: Optimise 1 pixel 2d ops, Gerd Hoffmann, 2020/06/15
- [PULL 1/4] sm501: Fix bounds checks,
Gerd Hoffmann <=
- Re: [PULL 0/4] Vga 20200615 patches, Peter Maydell, 2020/06/15
- Re: [PULL 0/4] Vga 20200615 patches, BALATON Zoltan, 2020/06/15