gwj / at91sam9263 · Commits

Commit 12c7e75a7c7048c0beb9196bbbedf0070ab29f53

Authored by Avi Kivity
Committed by Blue Swirl
1 parent 918a608b

[RESEND] Fix vga segfaults or screen corruption with large memory guests 

page0 and friends are ram addresses; a smaller size will overflow and
cause a segfault or random corruption.

Change them to ram_addr_t.

Signed-off-by: Avi Kivity <avi@redhat.com>
Inline Side-by-side
Showing 1 changed file with 6 additions and 5 deletions
hw/vga.c
  View file @12c7e75
... ... @@ -1584,8 +1584,9 @@ static void vga_sync_dirty_bitmap(VGAState *s)
1584 1584 */
1585 1585 static void vga_draw_graphic(VGAState *s, int full_update)
1586 1586 {
1587   - int y1, y, update, page_min, page_max, linesize, y_start, double_scan, mask, depth;
1588   - int width, height, shift_control, line_offset, page0, page1, bwidth, bits;
  1587 + int y1, y, update, linesize, y_start, double_scan, mask, depth;
  1588 + int width, height, shift_control, line_offset, bwidth, bits;
  1589 + ram_addr_t page0, page1, page_min, page_max;
1589 1590 int disp_width, multi_scan, multi_run;
1590 1591 uint8_t *d;
1591 1592 uint32_t v, addr1, addr;
... ... @@ -1723,8 +1724,8 @@ static void vga_draw_graphic(VGAState *s, int full_update)
1723 1724 addr1 = (s->start_addr * 4);
1724 1725 bwidth = (width * bits + 7) / 8;
1725 1726 y_start = -1;
1726   - page_min = 0x7fffffff;
1727   - page_max = -1;
  1727 + page_min = -1;
  1728 + page_max = 0;
1728 1729 d = ds_get_data(s->ds);
1729 1730 linesize = ds_get_linesize(s->ds);
1730 1731 y1 = 0;
... ... @@ -1791,7 +1792,7 @@ static void vga_draw_graphic(VGAState *s, int full_update)
1791 1792 disp_width, y - y_start);
1792 1793 }
1793 1794 /* reset modified pages */
1794   - if (page_max != -1) {
  1795 + if (page_max >= page_min) {
1795 1796 cpu_physical_memory_reset_dirty(page_min, page_max + TARGET_PAGE_SIZE,
1796 1797 VGA_DIRTY_FLAG);
1797 1798 }
... ...