diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2016-02-10 17:17:39 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2016-03-01 07:51:32 +0100 |
| commit | d2ba7ecb348d3b996fcd920cf1ca7b72722c1dfd (patch) | |
| tree | f18d1f4efca017b9b0d603b5461cf41bd23227c0 | |
| parent | 071608b519adf62bc29c914343a21c5407ab1ac9 (diff) | |
cirrus_vga: fix off-by-one in blit_region_is_unsafe
The "max" value is being compared with >=, but addr + width points to
the first byte that will _not_ be copied. Laszlo suggested using a
"greater than" comparison, instead of subtracting one like it is
already done above for the height, so that max remains always positive.
The mistake is "safe"---it will reject some blits, but will never cause
out-of-bounds writes.
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | hw/display/cirrus_vga.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c index b6ce1c8bc7..57b91a77ca 100644 --- a/hw/display/cirrus_vga.c +++ b/hw/display/cirrus_vga.c @@ -276,14 +276,14 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, + ((int64_t)s->cirrus_blt_height-1) * pitch; int32_t max = addr + s->cirrus_blt_width; - if (min < 0 || max >= s->vga.vram_size) { + if (min < 0 || max > s->vga.vram_size) { return true; } } else { int64_t max = addr + ((int64_t)s->cirrus_blt_height-1) * pitch + s->cirrus_blt_width; - if (max >= s->vga.vram_size) { + if (max > s->vga.vram_size) { return true; } } |