ati-vga: fix unsigned integer overflow in cursor bounds checks
The cursor bounds checks compare (srcoff + N) against vram_size, but both sides are uint32_t so the addition can wrap past UINT32_MAX when srcoff underflows from the cur_hv_offs subtraction, causing the check to be bypassed. Rewrite the checks as (srcoff > vram_size - N) to avoid the overflow-prone addition, matching the style already used in ati_mm_read() and ati_mm_write(). Cc: qemu-stable@nongnu.org Fixes: 2f1fbe6ee9b5 ("ati-vga: Make sure hardware cursor data is within vram") Signed-off-by: Junjie Cao <junjie.cao@intel.com> Message-ID: <20260414141458.1076014-1-junjie.cao@intel.com> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Junjie Cao committed
Apr 14, 2026 at 22:14 UTC
0990cc8b286b9981b2548c3d591584d22c7bf2f1
1 file changed
+2
-2
hw/display/ati.c
+2
-2
@@ -149,7 +149,7 @@ static void ati_cursor_define(ATIVGAState *s)
149
/* FIXME handle cur_hv_offs correctly */
150
srcoff = s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
151
(s->regs.cur_hv_offs & 0xffff) * 16;
152
- if (srcoff + 64 * 16 > s->vga.vram_size) {
152
+ if (srcoff > s->vga.vram_size - 64 * 16) {
153
return;
154
}
155
for (int i = 0; i < 64; i++, srcoff += 16) {
@@ -206,7 +206,7 @@ static void ati_cursor_draw_line(VGACommonState *vga, uint8_t *d, int scr_y)
206
}
207
/* FIXME handle cur_hv_offs correctly */
208
srcoff = s->cursor_offset + (scr_y - vga->hw_cursor_y) * 16;
209
- if (srcoff + 16 > s->vga.vram_size) {
209
+ if (srcoff > s->vga.vram_size - 16) {
210
return;
211
}
212
dp = &dp[vga->hw_cursor_x];