diff options
| author | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2021-10-07 23:12:44 +0100 |
|---|---|---|
| committer | Laurent Vivier <laurent@vivier.eu> | 2021-10-08 13:31:03 +0200 |
| commit | 14d0ddfce781374b7ce40062c0afc2ed00419267 (patch) | |
| tree | 91b68eba45d25307148ef11093e50129f6c9b58b /hw | |
| parent | 906c2323f1edf41b1851e7e36231023ee930aa3c (diff) | |
macfb: fix overflow of color_palette array
The palette_current index counter has a maximum size of 256 * 3 to cover a full
color palette of 256 RGB entries. Linux assumes that the palette_current index
wraps back around to zero after writing 256 RGB entries so ensure that
palette_current is reset at this point to prevent data corruption within
MacfbState.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20211007221253.29024-5-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/display/macfb.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/hw/display/macfb.c b/hw/display/macfb.c index b363bab889..39dab49026 100644 --- a/hw/display/macfb.c +++ b/hw/display/macfb.c @@ -303,7 +303,9 @@ static void macfb_ctrl_write(void *opaque, s->palette_current = 0; break; case DAFB_LUT: - s->color_palette[s->palette_current++] = val; + s->color_palette[s->palette_current] = val; + s->palette_current = (s->palette_current + 1) % + ARRAY_SIZE(s->color_palette); if (s->palette_current % 3) { macfb_invalidate_display(s); } |