[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [5880] do boundary check based on absolute value (Glauber C
From: |
Anthony Liguori |
Subject: |
[Qemu-devel] [5880] do boundary check based on absolute value (Glauber Costa) |
Date: |
Thu, 04 Dec 2008 22:36:38 +0000 |
Revision: 5880
http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=5880
Author: aliguori
Date: 2008-12-04 22:36:38 +0000 (Thu, 04 Dec 2008)
Log Message:
-----------
do boundary check based on absolute value (Glauber Costa)
For backward operations, dstpitch and srcpitch can
be negative. This leads BLTUNSAFE macro into an
overflow, and as a result, it avoids performing
operations that are perfectly valid.
The visible effect that led to that patch was the gnome-panel
bar in Fedora10. Before this patch, you could see garbage
clobbering a big portion of the bar.
After this patch, this garbage is gone.
Signed-off-by: Glauber Costa <address@hidden>
Modified Paths:
--------------
trunk/hw/cirrus_vga.c
Modified: trunk/hw/cirrus_vga.c
===================================================================
--- trunk/hw/cirrus_vga.c 2008-12-04 21:39:21 UTC (rev 5879)
+++ trunk/hw/cirrus_vga.c 2008-12-04 22:36:38 UTC (rev 5880)
@@ -221,15 +221,17 @@
#define CIRRUS_HOOK_NOT_HANDLED 0
#define CIRRUS_HOOK_HANDLED 1
+#define ABS(a) ((signed)(a) > 0 ? a : -a)
+
#define BLTUNSAFE(s) \
( \
( /* check dst is within bounds */ \
- (s)->cirrus_blt_height * (s)->cirrus_blt_dstpitch \
+ (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \
+ ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
(s)->vram_size \
) || \
( /* check src is within bounds */ \
- (s)->cirrus_blt_height * (s)->cirrus_blt_srcpitch \
+ (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \
+ ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
(s)->vram_size \
) \
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-devel] [5880] do boundary check based on absolute value (Glauber Costa),
Anthony Liguori <=