gwj / at91sam9263 · Commits

Commit 12c7e75a7c7048c0beb9196bbbedf0070ab29f53

Authored by Avi Kivity
Committed by Blue Swirl
1 parent 918a608b

[RESEND] Fix vga segfaults or screen corruption with large memory guests 

page0 and friends are ram addresses; a smaller size will overflow and
cause a segfault or random corruption.

Change them to ram_addr_t.

Signed-off-by: Avi Kivity <avi@redhat.com>
Inline Side-by-side
Showing 1 changed file with 6 additions and 5 deletions
hw/vga.c
  View file @12c7e75
@@ -1584,8 +1584,9 @@ static void vga_sync_dirty_bitmap(VGAState *s) @@ -1584,8 +1584,9 @@ static void vga_sync_dirty_bitmap(VGAState *s)
1584 */ 1584 */
1585 static void vga_draw_graphic(VGAState *s, int full_update) 1585 static void vga_draw_graphic(VGAState *s, int full_update)
1586 { 1586 {
1587 - int y1, y, update, page_min, page_max, linesize, y_start, double_scan, mask, depth;  
1588 - int width, height, shift_control, line_offset, page0, page1, bwidth, bits; 1587 + int y1, y, update, linesize, y_start, double_scan, mask, depth;
  1588 + int width, height, shift_control, line_offset, bwidth, bits;
  1589 + ram_addr_t page0, page1, page_min, page_max;
1589 int disp_width, multi_scan, multi_run; 1590 int disp_width, multi_scan, multi_run;
1590 uint8_t *d; 1591 uint8_t *d;
1591 uint32_t v, addr1, addr; 1592 uint32_t v, addr1, addr;
@@ -1723,8 +1724,8 @@ static void vga_draw_graphic(VGAState *s, int full_update) @@ -1723,8 +1724,8 @@ static void vga_draw_graphic(VGAState *s, int full_update)
1723 addr1 = (s->start_addr * 4); 1724 addr1 = (s->start_addr * 4);
1724 bwidth = (width * bits + 7) / 8; 1725 bwidth = (width * bits + 7) / 8;
1725 y_start = -1; 1726 y_start = -1;
1726 - page_min = 0x7fffffff;  
1727 - page_max = -1; 1727 + page_min = -1;
  1728 + page_max = 0;
1728 d = ds_get_data(s->ds); 1729 d = ds_get_data(s->ds);
1729 linesize = ds_get_linesize(s->ds); 1730 linesize = ds_get_linesize(s->ds);
1730 y1 = 0; 1731 y1 = 0;
@@ -1791,7 +1792,7 @@ static void vga_draw_graphic(VGAState *s, int full_update) @@ -1791,7 +1792,7 @@ static void vga_draw_graphic(VGAState *s, int full_update)
1791 disp_width, y - y_start); 1792 disp_width, y - y_start);
1792 } 1793 }
1793 /* reset modified pages */ 1794 /* reset modified pages */
1794 - if (page_max != -1) { 1795 + if (page_max >= page_min) {
1795 cpu_physical_memory_reset_dirty(page_min, page_max + TARGET_PAGE_SIZE, 1796 cpu_physical_memory_reset_dirty(page_min, page_max + TARGET_PAGE_SIZE,
1796 VGA_DIRTY_FLAG); 1797 VGA_DIRTY_FLAG);
1797 } 1798 }