Commit 349ebdd7 authored by BALATON Zoltan's avatar BALATON Zoltan Committed by Gerd Hoffmann
Browse files

ati-vga: Fix check for blt outside vram 



Fix the check preventing calling pixman functions that would access
memory outside allocated vram. The r128 X driver sometimes seem to try
blits that span outside vram, this check prevents crashing QEMU in
that case. (The r128 X driver may have problems even on real hardware
so I'm not sure if it's a client bug or emulation problem but at least
QEMU should survive.)

Signed-off-by: default avatarBALATON Zoltan <balaton@eik.bme.hu>
Tested-by: default avatarAndrew Randrianasulu <randrianasulu@gmail.com>
Message-Id: <20190409110732.5C5FF7465DB@zero.eik.bme.hu>
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 94932c95

hw/display/ati_2d.c

+6 −6
Original line number Diff line number Diff line
@@ -79,10 +79,10 @@ void ati_2d_blt(ATIVGAState *s) 
                s->regs.dst_width, s->regs.dst_height);

        end = s->vga.vram_ptr + s->vga.vram_size;

        if (src_bits >= end || dst_bits >= end ||

            src_bits + (s->regs.src_y + s->regs.dst_height) * src_stride +

            s->regs.src_x >= end ||

            dst_bits + (s->regs.dst_y + s->regs.dst_height) * dst_stride +

            s->regs.dst_x >= end) {

            src_bits + s->regs.src_x + (s->regs.src_y + s->regs.dst_height) *

            src_stride * sizeof(uint32_t) >= end ||

            dst_bits + s->regs.dst_x + (s->regs.dst_y + s->regs.dst_height) *

            dst_stride * sizeof(uint32_t) >= end) {

            qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");

            return;

        }
@@ -140,8 +140,8 @@ void ati_2d_blt(ATIVGAState *s) 
                filler);

        end = s->vga.vram_ptr + s->vga.vram_size;

        if (dst_bits >= end ||

            dst_bits + (s->regs.dst_y + s->regs.dst_height) * dst_stride +

            s->regs.dst_x >= end) {

            dst_bits + s->regs.dst_x + (s->regs.dst_y + s->regs.dst_height) *

            dst_stride * sizeof(uint32_t) >= end) {

            qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");

            return;

        }