ati-vga: Do not crash on 24 bits per pixel
The stn_he_p function only supports power of two sizes so it will assert if we call it with size 3 that happens with 24 bits per pixel. It's not clear from the documentation if this should be supported or not and drivers tested so far don't use it so refuse the parameters that would crash QEMU for now. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Chad Jablonski <chad@jablonski.xyz> Message-ID: <20260406012031.335A0596A24@zero.eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan committed
Apr 6, 2026 at 03:20 UTC
992e01e838733c8063f8a17e92034c5f35e34963
1 file changed
+9
hw/display/ati_2d.c
+9
@@ -265,6 +265,10 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)
265
{
266
uint32_t filler = 0;
267
268
+ if (ctx->bpp == 24) {
269
+ qemu_log_mask(LOG_UNIMP, "Fill blt unsupported in 24 bits\n");
270
+ return false;
271
+ }
272
switch (ctx->rop3) {
273
case ROP3_PATCOPY:
274
filler = make_filler(ctx->bpp, ctx->frgd_clr);
@@ -362,6 +366,11 @@ bool ati_host_data_flush(ATIVGAState *s)
366
367
setup_2d_blt_ctx(s, &ctx);
368
369
+ if (ctx.bpp == 24) {
370
+ qemu_log_mask(LOG_UNIMP,
371
+ "host_data_blt: unsupported in 24 bits mode\n");
372
+ return false;
373
+ }
374
if (!ctx.left_to_right || !ctx.top_to_bottom) {
375
qemu_log_mask(LOG_UNIMP,
376
"host_data_blt: unsupported blit direction %c%c\n",