@samitouri / QOSamiQemu / commits / 90f8e5c307

hw/display/ati: guard against zero bpp in ati_host_data_flush

ati_bpp_from_datatype() returns 0 for unrecognized dp_datatype nibble values (0, 1, or >= 7). ati_host_data_flush() only guards against the bpp == 24 case but not bpp == 0, leading to: 1. Division by zero at "pix_count /= ctx.bpp" (SIGFPE) when src_datatype is SRC_COLOR. 2. g_assert_not_reached() in stn_he_p() when bypp (= bpp/8 = 0) hits the default case of the size switch. Both are guest-triggerable via MMIO writes to the dp_datatype register while a HOST_DATA blit is active. Add an explicit bpp == 0 check with LOG_GUEST_ERROR before proceeding with the blit, consistent with the existing check in ati_2d_do_blt(). Cc: qemu-stable@nongnu.org Reported-by: Feifan Qian <bea1e@proton.me> Signed-off-by: Junjie Cao <junjie.cao@intel.com> Reviewed-by: Chad Jablonski <chad@jablonski.xyz> Message-ID: <20260519023937.439077-3-junjie.cao@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Junjie Cao committed May 19, 2026 at 10:39 UTC 90f8e5c307679b7468f73924e63682567a10564d

1 file changed +5

hw/display/ati_2d.c

@@ -377,6 +377,11 @@ bool ati_host_data_flush(ATIVGAState *s)

377

378 setup_2d_blt_ctx(s, &ctx);

379

380 + if (!ctx.bpp) {

381 + qemu_log_mask(LOG_GUEST_ERROR,

382 + "host_data_blt: invalid bpp from datatype\n");

383 + return false;

384 + }

385 if (ctx.bpp == 24) {

386 qemu_log_mask(LOG_UNIMP,

387 "host_data_blt: unsupported in 24 bits mode\n");