ati-vga: Fix check for overflowing vram
Take into account the bytes per pixels when checking for accessing beyond end of vram area. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20260408104935.1A55A5969F6@zero.eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan committed
Apr 8, 2026 at 12:49 UTC
a34f546c5f870980152899caddf45c730f867de2
1 file changed
+7
-6
hw/display/ati_2d.c
+7
-6
@@ -146,6 +146,7 @@ static uint32_t make_filler(int bpp, uint32_t color)
146
static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)
147
{
148
QemuRect vis_src, vis_dst;
149
+ unsigned int x, y, i, j, bypp = ctx->bpp / 8;
150
151
if (!ctx->bpp) {
152
qemu_log_mask(LOG_GUEST_ERROR, "Invalid bpp\n");
@@ -156,8 +157,9 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)
157
return false;
158
}
159
if (ctx->dst.x > 0x3fff || ctx->dst.y > 0x3fff ||
159
- ctx->dst_bits >= ctx->vram_end || ctx->dst_bits + ctx->dst.x +
160
- (ctx->dst.y + ctx->dst.height) * ctx->dst_stride >= ctx->vram_end) {
160
+ ctx->dst_bits >= ctx->vram_end - bypp ||
161
+ ctx->dst_bits + ctx->dst.x * bypp + (ctx->dst.y + ctx->dst.height) *
162
+ ctx->dst_stride >= ctx->vram_end - bypp) {
163
qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
164
return false;
165
}
@@ -194,8 +196,9 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)
196
}
197
if (!ctx->host_data_active &&
198
(vis_src.x > 0x3fff || vis_src.y > 0x3fff ||
197
- ctx->src_bits >= ctx->vram_end || ctx->src_bits + vis_src.x +
198
- (vis_src.y + vis_dst.height) * ctx->src_stride >= ctx->vram_end)) {
199
+ ctx->src_bits >= ctx->vram_end - bypp ||
200
+ ctx->src_bits + vis_src.x * bypp + (vis_src.y + vis_dst.height) *
201
+ ctx->src_stride >= ctx->vram_end - bypp)) {
202
qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
203
return false;
204
}
@@ -240,7 +243,6 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)
243
fallback = true;
244
}
245
if (fallback) {
243
- unsigned int y, i, j, bypp = ctx->bpp / 8;
246
for (y = 0; y < vis_dst.height; y++) {
247
i = vis_dst.x * bypp;
248
j = vis_src.x * bypp;
@@ -299,7 +301,6 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)
301
#endif
302
{
303
/* fallback when pixman failed or we don't want to call it */
302
- unsigned int x, y, i, bypp = ctx->bpp / 8;
304
for (y = 0; y < vis_dst.height; y++) {
305
i = vis_dst.x * bypp + (vis_dst.y + y) * ctx->dst_stride;
306
for (x = 0; x < vis_dst.width; x++, i += bypp) {