Commit 4299b90e authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Gerd Hoffmann
Browse files

display: cirrus: check vga bits per pixel(bpp) value 



In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA,
'cirrus_get_bpp' returns zero(0), which could lead to a divide
by zero error in while copying pixel data. The same could occur
via blit pitch values. Add check to avoid it.

Reported-by: default avatarHuawei PSIRT <psirt@huawei.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 2d1cd6c7

hw/display/cirrus_vga.c

+10 −4
Original line number Diff line number Diff line
@@ -272,6 +272,9 @@ static void cirrus_update_memory_access(CirrusVGAState *s); 
static bool blit_region_is_unsafe(struct CirrusVGAState *s,

                                  int32_t pitch, int32_t addr)

{

    if (!pitch) {

        return true;

    }

    if (pitch < 0) {

        int64_t min = addr

            + ((int64_t)s->cirrus_blt_height-1) * pitch;
@@ -715,7 +718,7 @@ static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s) 
                                            s->cirrus_addr_mask));

}



static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)

static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)

{

    int sx = 0, sy = 0;

    int dx = 0, dy = 0;
@@ -729,6 +732,9 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) 
        int width, height;



        depth = s->vga.get_bpp(&s->vga) / 8;

        if (!depth) {

            return 0;

        }

        s->vga.get_resolution(&s->vga, &width, &height);



        /* extra x, y */
@@ -783,6 +789,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) 
    cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,

				s->cirrus_blt_dstpitch, s->cirrus_blt_width,

				s->cirrus_blt_height);



    return 1;

}



static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
@@ -790,11 +798,9 @@ static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) 
    if (blit_is_unsafe(s))

        return 0;



    cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,

    return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,

            s->cirrus_blt_srcaddr - s->vga.start_addr,

            s->cirrus_blt_width, s->cirrus_blt_height);



    return 1;

}



/***************************************