cirrusfb division by zero

[Marcelo Tosatti <mtosatti@redhat.com>]

Anthony, 

The following sequence crashes F9 guests, when using VNC:

# modprobe cirrusfb
# vbetool post

Results in Floating point exception at:

cirrus_do_copy()
{

    depth = s->get_bpp((VGAState *)s) / 8 
    ...
    sx = (src % (width * depth)) / depth;
    ...
}

Problem is that ->get_bpp returns 0.

Following band-aid "fixes it" (coff). I have no idea if its correct
though ?

"vbetool post" corrupts both SDL and VNC displays when using cirrusfb,
but seems a separate problem.


diff --git a/qemu/hw/cirrus_vga.c b/qemu/hw/cirrus_vga.c
index e14ec35..9f860ff 100644
--- a/qemu/hw/cirrus_vga.c
+++ b/qemu/hw/cirrus_vga.c
@@ -709,6 +709,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, in     int notify = 0;

     depth = s->get_bpp((VGAState *)s) / 8;
+    if (!depth)
+        depth = 1;
     s->get_resolution((VGAState *)s, &width, &height);

     /* extra x, y */


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone