diff options
| author | BALATON Zoltan | 2020-04-06 22:34:26 +0200 |
|---|---|---|
| committer | Gerd Hoffmann | 2020-04-07 09:25:23 +0200 |
| commit | ac2071c3791b67fc7af78b8ceb320c01ca1b5df7 (patch) | |
| tree | 0e951ae17812aac4ca3ca98d695e6b676480a4e2 /hw/display/sm501.c | |
| parent | dsoundaudio: dsound_get_buffer_in should honor *size (diff) | |
| download | qemu-ac2071c3791b67fc7af78b8ceb320c01ca1b5df7.tar.gz qemu-ac2071c3791b67fc7af78b8ceb320c01ca1b5df7.tar.xz qemu-ac2071c3791b67fc7af78b8ceb320c01ca1b5df7.zip | |
ati-vga: Fix checks in ati_2d_blt() to avoid crash
In some corner cases (that never happen during normal operation but a
malicious guest could program wrong values) pixman functions were
called with parameters that result in a crash. Fix this and add more
checks to disallow such cases.
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/display/sm501.c')
0 files changed, 0 insertions, 0 deletions