Re: [PATCH] hw/display/tcx: use memmove instead of memcpy for overlapping blit memory regions

["Michael S. Tsirkin" <mst@redhat.com>]

thanks for the patch! some questions:

On Tue, Sep 15, 2026 at 07:20:46PM +0300, Николай Зорин wrote:
> SWSA#34e3af79-c6c2-4ad2-986f-313c1ce28e5a

what is this?

> In `tcx_blit_writel()`, memory copying occurs within the same video RAM
> buffers (`vram` and `vram24`) using source and destination offsets that
> can potentially overlap during blit operations.
> 
> Using `memcpy()` on overlapping memory regions triggers undefined behavior
> according to the C standard. Depending on compiler optimizations, this
> can lead to graphical artifacts, memory corruption, or unexpected
> behavior in the guest system.

was this actually observed? in which configuration? which guest?
why does the guest do such overlapping blit write?

it also seems unlikely to depend on optimizations - more likely
on libc.

> Fix this by replacing `memcpy()` with `memmove()`, which explicitly
> guarantees safe and correct behavior when memory regions overlap.
> 
> Signed-off-by: Nikolay N Zorin <zorin@swemel.ru>
> ---
>  hw/display/tcx.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/display/tcx.c b/hw/display/tcx.c
> index 2cfc1e8f..fb48a199 100644
> --- a/hw/display/tcx.c
> +++ b/hw/display/tcx.c
> @@ -587,9 +587,9 @@ static void tcx_blit_writel(void *opaque, hwaddr addr,
>                  }
>              }
>          } else {
> -            memcpy(&s->vram[addr], &s->vram[adsr], len);
> +            memmove(&s->vram[addr], &s->vram[adsr], len);
>              if (s->depth == 24) {
> -                memcpy(&s->vram24[addr], &s->vram24[adsr], len * 4);
> +                memmove(&s->vram24[addr], &s->vram24[adsr], len * 4);
>              }
>          }
>          tcx_set_dirty(s, addr, len);
> -- 
> 2.43.0