avoid segfault if transient invalid text resolution

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@727 c046a42c-6fe2-441c-8c8c-71466251a162

1 files changed, 5 insertions, 0 deletions

diff --git a/hw/vga.c b/hw/vga.c
index 1321f7b24a..3a634a4d53 100644
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -1154,6 +1154,11 @@ static void vga_draw_text(VGAState *s, int full_update)
             ((s->cr[0x07] & 0x40) << 3);
         height = (height + 1) / cheight;
     }
+    if ((height * width) > CH_ATTR_SIZE) {
+        /* better than nothing: exit if transient size is too big */
+        return;
+    }
+
     if (width != s->last_width || height != s->last_height ||
         cw != s->last_cw || cheight != s->last_ch) {
         s->last_scr_width = width * cw;