From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1L8Lzs-0005vz-Ng for qemu-devel@nongnu.org; Thu, 04 Dec 2008 16:44:32 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1L8Lzp-0005uZ-8R for qemu-devel@nongnu.org; Thu, 04 Dec 2008 16:44:32 -0500 Received: from [199.232.76.173] (port=50341 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1L8Lzp-0005uT-0l for qemu-devel@nongnu.org; Thu, 04 Dec 2008 16:44:29 -0500 Received: from mx2.redhat.com ([66.187.237.31]:53521) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1L8Lzl-0000MP-46 for qemu-devel@nongnu.org; Thu, 04 Dec 2008 16:44:28 -0500 From: Glauber Costa Date: Thu, 4 Dec 2008 16:44:06 -0500 Message-Id: <1228427046-28875-1-git-send-email-glommer@redhat.com> Subject: [Qemu-devel] [PATCH] do boundary check based on absolute value Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: avi@redhat.com, kvm@vger.kernel.org For backward operations, dstpitch and srcpitch can be negative. This leads BLTUNSAFE macro into an overflow, and as a result, it avoids performing operations that are perfectly valid. The visible effect that led to that patch was the gnome-panel bar in Fedora10. Before this patch, you could see garbage clobbering a big portion of the bar. After this patch, this garbage is gone. Signed-off-by: Glauber Costa --- hw/cirrus_vga.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c index e0cf458..5690719 100644 --- a/hw/cirrus_vga.c +++ b/hw/cirrus_vga.c @@ -221,15 +221,17 @@ #define CIRRUS_HOOK_NOT_HANDLED 0 #define CIRRUS_HOOK_HANDLED 1 +#define ABS(a) ((signed)(a) > 0 ? a : -a) + #define BLTUNSAFE(s) \ ( \ ( /* check dst is within bounds */ \ - (s)->cirrus_blt_height * (s)->cirrus_blt_dstpitch \ + (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \ + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \ (s)->vram_size \ ) || \ ( /* check src is within bounds */ \ - (s)->cirrus_blt_height * (s)->cirrus_blt_srcpitch \ + (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \ + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \ (s)->vram_size \ ) \ -- 1.5.6.5