gwj / at91sam9263 · Commits

Commit a8fbaf96e0791d72078d22b75c5f3c1f1d1ee45d

Authored by balrog
1 parent 3016d80b
gwj ... at91sam9263_support

Check for out of range update regions (original patch from Anthony Liguori). 

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4024 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 1 changed file with 27 additions and 6 deletions
hw/vmware_vga.c
  View file @a8fbaf9
... ... @@ -291,12 +291,33 @@ static inline void vmsvga_update_rect(struct vmsvga_state_s *s,
291 291 int x, int y, int w, int h)
292 292 {
293 293 #ifndef DIRECT_VRAM
294   - int line = h;
295   - int bypl = s->bypp * s->width;
296   - int width = s->bypp * w;
297   - int start = s->bypp * x + bypl * y;
298   - uint8_t *src = s->vram + start;
299   - uint8_t *dst = s->ds->data + start;
  294 + int line;
  295 + int bypl;
  296 + int width;
  297 + int start;
  298 + uint8_t *src;
  299 + uint8_t *dst;
  300 +
  301 + if (x + w > s->width) {
  302 + fprintf(stderr, "%s: update width too large x: %d, w: %d\n",
  303 + __FUNCTION__, x, w);
  304 + x = MIN(x, s->width);
  305 + w = s->width - x;
  306 + }
  307 +
  308 + if (y + h > s->height) {
  309 + fprintf(stderr, "%s: update height too large y: %d, h: %d\n",
  310 + __FUNCTION__, y, h);
  311 + y = MIN(y, s->height);
  312 + h = s->height - y;
  313 + }
  314 +
  315 + line = h;
  316 + bypl = s->bypp * s->width;
  317 + width = s->bypp * w;
  318 + start = s->bypp * x + bypl * y;
  319 + src = s->vram + start;
  320 + dst = s->ds->data + start;
300 321  
301 322 for (; line > 0; line --, src += bypl, dst += bypl)
302 323 memcpy(dst, src, width);
... ...