[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue
From: |
Gerd Hoffmann |
Subject: |
Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue |
Date: |
Tue, 24 Jan 2017 11:48:50 +0100 |
> > diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
> > index 379910d..7ddd289 100644
> > --- a/hw/display/cirrus_vga.c
> > +++ b/hw/display/cirrus_vga.c
> > @@ -277,7 +277,8 @@ static bool blit_region_is_unsafe(struct CirrusVGAState
> > *s,
> > }
> > if (pitch < 0) {
> > int64_t min = addr
> > - + ((int64_t)s->cirrus_blt_height-1) * pitch;
> > + + ((int64_t)s->cirrus_blt_height-1) * pitch
> > + - s->cirrus_blt_width;
> > int32_t max = addr
> > + s->cirrus_blt_width;
> > if (min < 0 || max > s->vga.vram_size) {
> >
>
> I believe this is incorrect. In this case (AFAIR), "addr" points to the
> left-most pixel (= lowest address) of the bottom line (= highest
> address).
If I read the code correctly it is backwards *both* x and y axis, so
addr is the right-most pixel of the bottom line.
cheers,
Gerd
- [Qemu-devel] [PATCH] cirrus: fix oob access issue, Li Qiang, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, no-reply, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Laszlo Ersek, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue,
Gerd Hoffmann <=
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Laszlo Ersek, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Laszlo Ersek, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Gerd Hoffmann, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Wolfgang Bumiller, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Laszlo Ersek, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Li Qiang, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Laszlo Ersek, 2017/01/24
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Gerd Hoffmann, 2017/01/25
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Gerd Hoffmann, 2017/01/25
- Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue, Laszlo Ersek, 2017/01/25