summaryrefslogtreecommitdiffstats
path: root/hw/display/cirrus_vga_rop.h
diff options
context:
space:
mode:
authorGerd Hoffmann2017-03-17 08:21:36 +0100
committerGerd Hoffmann2017-03-17 10:23:44 +0100
commitf019722cbbb45aea153294fc8921fcc96a4d3fa2 (patch)
treed7c182a5850b8951b91896b9d7b42ef49aa302bd /hw/display/cirrus_vga_rop.h
parentui/console: ensure graphic updates don't race with TCG vCPUs (diff)
downloadqemu-f019722cbbb45aea153294fc8921fcc96a4d3fa2.tar.gz
qemu-f019722cbbb45aea153294fc8921fcc96a4d3fa2.tar.xz
qemu-f019722cbbb45aea153294fc8921fcc96a4d3fa2.zip
cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16
The switch from pointers to addresses (commit 026aeffcb4752054830ba203020ed6eb05bcaba8 and ffaf857778286ca54e3804432a2369a279e73aa7) added a off-by-one bug to 16bit backward blits. Fix. Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com
Diffstat (limited to 'hw/display/cirrus_vga_rop.h')
-rw-r--r--hw/display/cirrus_vga_rop.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/display/cirrus_vga_rop.h b/hw/display/cirrus_vga_rop.h
index c61a677353..0841b9efa9 100644
--- a/hw/display/cirrus_vga_rop.h
+++ b/hw/display/cirrus_vga_rop.h
@@ -219,7 +219,7 @@ glue(glue(cirrus_bitblt_rop_bkwd_transp_, ROP_NAME),_16)(CirrusVGAState *s,
srcpitch += bltwidth;
for (y = 0; y < bltheight; y++) {
for (x = 0; x < bltwidth; x+=2) {
- ROP_OP_TR_16(s, dstaddr, cirrus_src16(s, srcaddr), transp);
+ ROP_OP_TR_16(s, dstaddr - 1, cirrus_src16(s, srcaddr - 1), transp);
dstaddr -= 2;
srcaddr -= 2;
}