[Qemu-devel] [PATCH v3] cirrus_vga: adding sanity check for vram size

[arei.gonglei]

From: Gonglei <address@hidden>

when configure a invalid vram size for cirrus card, such as less
2 MB, which will crash qemu. Follow the real hardware, the cirrus
card has 4 MB video memory. Also for backward compatibility, accept
8 MB and 16 MB vram size.

Signed-off-by: Gonglei <address@hidden>
---
v3: 
 - fix logic bug pointed out by Michael Tokarev
 - add the same restriction for ISA cirrus device, thanks Andreas
v2: 
 - fix checkpatch fails.
   "WARNING: suspect code indent for conditional statements (5, 9)"
   maybe not a real warning.
 
 hw/display/cirrus_vga.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index d1afc76..ca0d786 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2913,6 +2913,14 @@ static void isa_cirrus_vga_realizefn(DeviceState *dev, 
Error **errp)
     ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);
     VGACommonState *s = &d->cirrus_vga.vga;
 
+    /* follow real hardware, cirrus card emulated has 4 MB video memory.
+       Also accept 8 MB/16 MB for backward compatibility. */
+    if (s->vram_size_mb != 4 && s->vram_size_mb != 8 &&
+        s->vram_size_mb != 16) {
+        error_setg(errp, "Invalid cirrus_vga ram size '%u'",
+                   s->vram_size_mb);
+        return;
+    }
     vga_common_init(s, OBJECT(dev), true);
     cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,
                        isa_address_space(isadev),
@@ -2959,6 +2967,14 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
      int16_t device_id = pc->device_id;
 
+     /* follow real hardware, cirrus card emulated has 4 MB video memory.
+       Also accept 8 MB/16 MB for backward compatibility. */
+     if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
+         s->vga.vram_size_mb != 16) {
+         error_report("Invalid cirrus_vga ram size '%u'",
+                      s->vga.vram_size_mb);
+         return -1;
+     }
      /* setup VGA */
      vga_common_init(&s->vga, OBJECT(dev), true);
      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
-- 
1.7.12.4