diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2016-02-10 17:17:39 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2016-03-01 07:51:32 +0100 |
| commit | d2ba7ecb348d3b996fcd920cf1ca7b72722c1dfd (patch) | |
| tree | f18d1f4efca017b9b0d603b5461cf41bd23227c0 /hw/watchdog | |
| parent | 071608b519adf62bc29c914343a21c5407ab1ac9 (diff) | |
cirrus_vga: fix off-by-one in blit_region_is_unsafe
The "max" value is being compared with >=, but addr + width points to
the first byte that will _not_ be copied. Laszlo suggested using a
"greater than" comparison, instead of subtracting one like it is
already done above for the height, so that max remains always positive.
The mistake is "safe"---it will reject some blits, but will never cause
out-of-bounds writes.
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/watchdog')
0 files changed, 0 insertions, 0 deletions