do boundary check based on absolute value (Glauber Costa)

For backward operations, dstpitch and srcpitch can be negative. This leads BLTUNSAFE macro into an overflow, and as a result, it avoids performing operations that are perfectly valid. The visible effect that led to that patch was the gnome-panel bar in Fedora10. Before this patch, you could see garbage clobbering a big portion of the bar. After this patch, this garbage is gone. Signed-off-by: Glauber Costa <glommer@redhat.com> git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5880 c046a42c-6fe2-441c-8c8c-71466251a162

do boundary check based on absolute value (Glauber Costa)
For backward operations, dstpitch and srcpitch can be negative. This leads BLTUNSAFE macro into an overflow, and as a result, it avoids performing operations that are perfectly valid. The visible effect that led to that patch was the gnome-panel bar in Fedora10. Before this patch, you could see garbage clobbering a big portion of the bar. After this patch, this garbage is gone. Signed-off-by: Glauber Costa <glommer@redhat.com> git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5880 c046a42c-6fe2-441c-8c8c-71466251a162
aliguori
1 parent 4dc822d7
Showing 1 changed file with 4 additions and 2 deletions
hw/cirrus_vga.c
@@ -221,15 +221,17 @@
 #define CIRRUS_HOOK_NOT_HANDLED 0
 #define CIRRUS_HOOK_HANDLED 1
+#define ABS(a) ((signed)(a) > 0 ? a : -a)
+
 #define BLTUNSAFE(s) \
     ( \
         ( /* check dst is within bounds */ \
-            (s)->cirrus_blt_height * (s)->cirrus_blt_dstpitch \
+            (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \
                 + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
                     (s)->vram_size \
         ) || \
         ( /* check src is within bounds */ \
-            (s)->cirrus_blt_height * (s)->cirrus_blt_srcpitch \
+            (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \
                 + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
                     (s)->vram_size \
         ) \