Commit f61d82c2 authored by Gonglei's avatar Gonglei Committed by Gerd Hoffmann
Browse files

cirrus_vga: adding sanity check for vram size 



when configure a invalid vram size for cirrus card, such as less
2 MB, which will crash qemu. Follow the real hardware, the cirrus
card has 4 MB video memory. Also for backward compatibility, accept
8 MB and 16 MB vram size.

Signed-off-by: default avatarGonglei <arei.gonglei@huawei.com>
Reviewed-by: default avatarAndreas Färber <afaerber@suse.de>
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 9e99c5fd

hw/display/cirrus_vga.c

+16 −0
Original line number Diff line number Diff line
@@ -2911,6 +2911,14 @@ static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp) 
    ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);

    VGACommonState *s = &d->cirrus_vga.vga;



    /* follow real hardware, cirrus card emulated has 4 MB video memory.

       Also accept 8 MB/16 MB for backward compatibility. */

    if (s->vram_size_mb != 4 && s->vram_size_mb != 8 &&

        s->vram_size_mb != 16) {

        error_setg(errp, "Invalid cirrus_vga ram size '%u'",

                   s->vram_size_mb);

        return;

    }

    vga_common_init(s, OBJECT(dev), true);

    cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,

                       isa_address_space(isadev),
@@ -2957,6 +2965,14 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev) 
     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);

     int16_t device_id = pc->device_id;



     /* follow real hardware, cirrus card emulated has 4 MB video memory.

       Also accept 8 MB/16 MB for backward compatibility. */

     if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&

         s->vga.vram_size_mb != 16) {

         error_report("Invalid cirrus_vga ram size '%u'",

                      s->vga.vram_size_mb);

         return -1;

     }

     /* setup VGA */

     vga_common_init(&s->vga, OBJECT(dev), true);

     cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),