Commit a8fbaf96e0791d72078d22b75c5f3c1f1d1ee45d
1 parent
3016d80b
Check for out of range update regions (original patch from Anthony Liguori).
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4024 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
1 changed file
with
27 additions
and
6 deletions
hw/vmware_vga.c
... | ... | @@ -291,12 +291,33 @@ static inline void vmsvga_update_rect(struct vmsvga_state_s *s, |
291 | 291 | int x, int y, int w, int h) |
292 | 292 | { |
293 | 293 | #ifndef DIRECT_VRAM |
294 | - int line = h; | |
295 | - int bypl = s->bypp * s->width; | |
296 | - int width = s->bypp * w; | |
297 | - int start = s->bypp * x + bypl * y; | |
298 | - uint8_t *src = s->vram + start; | |
299 | - uint8_t *dst = s->ds->data + start; | |
294 | + int line; | |
295 | + int bypl; | |
296 | + int width; | |
297 | + int start; | |
298 | + uint8_t *src; | |
299 | + uint8_t *dst; | |
300 | + | |
301 | + if (x + w > s->width) { | |
302 | + fprintf(stderr, "%s: update width too large x: %d, w: %d\n", | |
303 | + __FUNCTION__, x, w); | |
304 | + x = MIN(x, s->width); | |
305 | + w = s->width - x; | |
306 | + } | |
307 | + | |
308 | + if (y + h > s->height) { | |
309 | + fprintf(stderr, "%s: update height too large y: %d, h: %d\n", | |
310 | + __FUNCTION__, y, h); | |
311 | + y = MIN(y, s->height); | |
312 | + h = s->height - y; | |
313 | + } | |
314 | + | |
315 | + line = h; | |
316 | + bypl = s->bypp * s->width; | |
317 | + width = s->bypp * w; | |
318 | + start = s->bypp * x + bypl * y; | |
319 | + src = s->vram + start; | |
320 | + dst = s->ds->data + start; | |
300 | 321 | |
301 | 322 | for (; line > 0; line --, src += bypl, dst += bypl) |
302 | 323 | memcpy(dst, src, width); | ... | ... |