diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2020-11-04 22:13:02 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2020-11-04 22:13:02 +0000 |
| commit | e2766868d45d8c8f8991cfd133e6a0c14abfe577 (patch) | |
| tree | 5f083618eae1d4872af84cae14188c4fb02188b6 /hw | |
| parent | 3c8c36c9087da957f580a9bb5ebf7814a753d1c6 (diff) | |
| parent | 577b808b0974fa4af53131cdfece6e9de3c6e4fd (diff) | |
| download | qemu-e2766868d45d8c8f8991cfd133e6a0c14abfe577.zip qemu-e2766868d45d8c8f8991cfd133e6a0c14abfe577.tar.gz qemu-e2766868d45d8c8f8991cfd133e6a0c14abfe577.tar.bz2 | |
Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20201104-pull-request' into staging
misc bugfixes for 5.2
# gpg: Signature made Wed 04 Nov 2020 15:46:33 GMT
# gpg: using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/fixes-20201104-pull-request:
roms/Makefile: Add qboot to .PHONY list
ati: check x y display parameter values
vnc: fix resource leak when websocket channel error
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/display/ati_2d.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index 23a8ae0..4dc10ea 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s) dst_stride *= bpp; } uint8_t *end = s->vga.vram_ptr + s->vga.vram_size; - if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) * - dst_stride >= end) { + if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end + || dst_bits + dst_x + + (dst_y + s->regs.dst_height) * dst_stride >= end) { qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n"); return; } @@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s) src_bits += s->regs.crtc_offset & 0x07ffffff; src_stride *= bpp; } - if (src_bits >= end || src_bits + src_x + - (src_y + s->regs.dst_height) * src_stride >= end) { + if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end + || src_bits + src_x + + (src_y + s->regs.dst_height) * src_stride >= end) { qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n"); return; } |