Commit 3294b949eb97f41e29432830370eba62a6d5f28d
1 parent
2aebb3eb
avoid segfault if transient invalid text resolution
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@727 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
1 changed file
with
5 additions
and
0 deletions
hw/vga.c
| @@ -1154,6 +1154,11 @@ static void vga_draw_text(VGAState *s, int full_update) | @@ -1154,6 +1154,11 @@ static void vga_draw_text(VGAState *s, int full_update) | ||
| 1154 | ((s->cr[0x07] & 0x40) << 3); | 1154 | ((s->cr[0x07] & 0x40) << 3); |
| 1155 | height = (height + 1) / cheight; | 1155 | height = (height + 1) / cheight; |
| 1156 | } | 1156 | } |
| 1157 | + if ((height * width) > CH_ATTR_SIZE) { | ||
| 1158 | + /* better than nothing: exit if transient size is too big */ | ||
| 1159 | + return; | ||
| 1160 | + } | ||
| 1161 | + | ||
| 1157 | if (width != s->last_width || height != s->last_height || | 1162 | if (width != s->last_width || height != s->last_height || |
| 1158 | cw != s->last_cw || cheight != s->last_ch) { | 1163 | cw != s->last_cw || cheight != s->last_ch) { |
| 1159 | s->last_scr_width = width * cw; | 1164 | s->last_scr_width = width * cw; |