@samitouri / QOSamiQemu / commits / b378a1bd86

hw/display/sm501: Catch bad coordinates for RTL operations

The sm501 code doesn't check whether a right-to-left operation has specified a width greater than the x-coordinate (which would make it extend off the left edge of the screen), or similarly a height greater than the y-coordinate. This means the guest can misprogram the device so that we underflow when calculating the address of the top left pixel, which might result in accessing out of bounds memory. Catch this as a guest error and ignore the operation. Reported-by: Yannick Wang Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20260707150933.1410507-2-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3920 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Peter Maydell committed Jul 13, 2026 at 12:34 UTC b378a1bd86b4f25255eada916e34ebd66a3e7437

1 file changed +8

hw/display/sm501.c

@@ -723,6 +723,10 @@ static void sm501_2d_operation(SM501State *s)

723 }

724

725 if (rtl) {

726 + if (dst_x < (width - 1) || dst_y < (height - 1)) {

727 + qemu_log_mask(LOG_GUEST_ERROR, "sm501: RTL op out of bounds\n");

728 + return;

729 + }

730 dst_x -= width - 1;

731 dst_y -= height - 1;

732 }

@@ -748,6 +752,10 @@ static void sm501_2d_operation(SM501State *s)

752 }

753

754 if (rtl) {

755 + if (src_x < (width - 1) || src_y < (height - 1)) {

756 + qemu_log_mask(LOG_GUEST_ERROR, "sm501: RTL op out of bounds\n");

757 + return;

758 + }

759 src_x -= width - 1;

760 src_y -= height - 1;

761 }