mirror of https://gitee.com/openkylin/qemu.git
hw/display/artist.c: fix out of bounds check
Fix the following runtime warning with artist framebuffer: "write outside bounds: wants 1256x1023, max size 1280x1024" Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Helge Deller <deller@gmx.de>
This commit is contained in:
parent
28b71a2e42
commit
a24d2cf30c
|
@ -340,14 +340,13 @@ static void vram_bit_write(ARTISTState *s, int posx, int posy, bool incr_x,
|
||||||
{
|
{
|
||||||
struct vram_buffer *buf;
|
struct vram_buffer *buf;
|
||||||
uint32_t vram_bitmask = s->vram_bitmask;
|
uint32_t vram_bitmask = s->vram_bitmask;
|
||||||
int mask, i, pix_count, pix_length, offset, height, width;
|
int mask, i, pix_count, pix_length, offset, width;
|
||||||
uint8_t *data8, *p;
|
uint8_t *data8, *p;
|
||||||
|
|
||||||
pix_count = vram_write_pix_per_transfer(s);
|
pix_count = vram_write_pix_per_transfer(s);
|
||||||
pix_length = vram_pixel_length(s);
|
pix_length = vram_pixel_length(s);
|
||||||
|
|
||||||
buf = vram_write_buffer(s);
|
buf = vram_write_buffer(s);
|
||||||
height = buf->height;
|
|
||||||
width = buf->width;
|
width = buf->width;
|
||||||
|
|
||||||
if (s->cmap_bm_access) {
|
if (s->cmap_bm_access) {
|
||||||
|
@ -367,13 +366,6 @@ static void vram_bit_write(ARTISTState *s, int posx, int posy, bool incr_x,
|
||||||
pix_count = size * 8;
|
pix_count = size * 8;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (posy * width + posx + pix_count > buf->size) {
|
|
||||||
qemu_log("write outside bounds: wants %dx%d, max size %dx%d\n",
|
|
||||||
posx, posy, width, height);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
switch (pix_length) {
|
switch (pix_length) {
|
||||||
case 0:
|
case 0:
|
||||||
if (s->image_bitmap_op & 0x20000000) {
|
if (s->image_bitmap_op & 0x20000000) {
|
||||||
|
@ -381,8 +373,11 @@ static void vram_bit_write(ARTISTState *s, int posx, int posy, bool incr_x,
|
||||||
}
|
}
|
||||||
|
|
||||||
for (i = 0; i < pix_count; i++) {
|
for (i = 0; i < pix_count; i++) {
|
||||||
artist_rop8(s, p + offset + pix_count - 1 - i,
|
uint32_t off = offset + pix_count - 1 - i;
|
||||||
(data & 1) ? (s->plane_mask >> 24) : 0);
|
if (off < buf->size) {
|
||||||
|
artist_rop8(s, p + off,
|
||||||
|
(data & 1) ? (s->plane_mask >> 24) : 0);
|
||||||
|
}
|
||||||
data >>= 1;
|
data >>= 1;
|
||||||
}
|
}
|
||||||
memory_region_set_dirty(&buf->mr, offset, pix_count);
|
memory_region_set_dirty(&buf->mr, offset, pix_count);
|
||||||
|
@ -398,7 +393,10 @@ static void vram_bit_write(ARTISTState *s, int posx, int posy, bool incr_x,
|
||||||
for (i = 3; i >= 0; i--) {
|
for (i = 3; i >= 0; i--) {
|
||||||
if (!(s->image_bitmap_op & 0x20000000) ||
|
if (!(s->image_bitmap_op & 0x20000000) ||
|
||||||
s->vram_bitmask & (1 << (28 + i))) {
|
s->vram_bitmask & (1 << (28 + i))) {
|
||||||
artist_rop8(s, p + offset + 3 - i, data8[ROP8OFF(i)]);
|
uint32_t off = offset + 3 - i;
|
||||||
|
if (off < buf->size) {
|
||||||
|
artist_rop8(s, p + off, data8[ROP8OFF(i)]);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
memory_region_set_dirty(&buf->mr, offset, 3);
|
memory_region_set_dirty(&buf->mr, offset, 3);
|
||||||
|
@ -420,7 +418,7 @@ static void vram_bit_write(ARTISTState *s, int posx, int posy, bool incr_x,
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
for (i = 0; i < pix_count; i++) {
|
for (i = 0; i < pix_count && offset + i < buf->size; i++) {
|
||||||
mask = 1 << (pix_count - 1 - i);
|
mask = 1 << (pix_count - 1 - i);
|
||||||
|
|
||||||
if (!(s->image_bitmap_op & 0x20000000) ||
|
if (!(s->image_bitmap_op & 0x20000000) ||
|
||||||
|
|
Loading…
Reference in New Issue