| commit | d2ba7ecb348d3b996fcd920cf1ca7b72722c1dfd | |
| author | Paolo Bonzini <pbonzini@redhat.com> | |
| Wed, 10 Feb 2016 16:17:39 +0000 (10 17:17 +0100) | ||
| committer | Gerd Hoffmann <kraxel@redhat.com> | |
| Tue, 1 Mar 2016 06:51:32 +0000 (1 07:51 +0100) | ||
| tree | f18d1f4efca017b9b0d603b5461cf41bd23227c0 | treesnapshot (tar.gz zip) |
| parent | 071608b519adf62bc29c914343a21c5407ab1ac9 | commitdiff |
cirrus_vga: fix off-by-one in blit_region_is_unsafe
The "max" value is being compared with >=, but addr + width points to
the first byte that will _not_ be copied. Laszlo suggested using a
"greater than" comparison, instead of subtracting one like it is
already done above for the height, so that max remains always positive.
The mistake is "safe"---it will reject some blits, but will never cause
out-of-bounds writes.
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
The "max" value is being compared with >=, but addr + width points to
the first byte that will _not_ be copied. Laszlo suggested using a
"greater than" comparison, instead of subtracting one like it is
already done above for the height, so that max remains always positive.
The mistake is "safe"---it will reject some blits, but will never cause
out-of-bounds writes.
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| hw/display/cirrus_vga.c | diffblobblamehistory |