yannick.naumann/RT-Task-Generator-QEMU
1
0
Fork 0
forked from alwin.berger/FRET-qemu
Code Pull Requests Activity

sm501: Fix bounds checks

Browse Source 
We don't need to add width to pitch when calculating last point, that
would reject valid ops within the card's local_mem.

Fixes: b15a22bbcbe6a78dc3d88fe3134985e4cdd87de4
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: ddb5781d12913bb9d6dbfd9e5b1e2b893e2b3e2d.1592686588.git.balaton@eik.bme.hu
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
BALATON Zoltan 2020-06-20 22:56:28 +02:00 committed by Gerd Hoffmann
parent fc1bff9589
commit 84ec3f9402
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hw/display/sm501.c
View File

@ -723,8 +723,8 @@ static void sm501_2d_operation(SM501State *s)
dst_y -= height - 1;
}
if (dst_base >= get_local_mem_size(s) || dst_base +
(dst_x + width + (dst_y + height) * (dst_pitch + width)) *
if (dst_base >= get_local_mem_size(s) ||
dst_base + (dst_x + width + (dst_y + height) * dst_pitch) *
(1 << format) >= get_local_mem_size(s)) {
qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n");
return;
@ -749,8 +749,8 @@ static void sm501_2d_operation(SM501State *s)
src_y -= height - 1;
}
if (src_base >= get_local_mem_size(s) || src_base +
(src_x + width + (src_y + height) * (src_pitch + width)) *
if (src_base >= get_local_mem_size(s) ||
src_base + (src_x + width + (src_y + height) * src_pitch) *
(1 << format) >= get_local_mem_size(s)) {
qemu_log_mask(LOG_GUEST_ERROR,
"sm501: 2D op src is outside vram.\n");