From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LtJ7y-0006EU-Gg for qemu-devel@nongnu.org; Mon, 13 Apr 2009 06:10:58 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LtJ7t-0006Bo-IH for qemu-devel@nongnu.org; Mon, 13 Apr 2009 06:10:57 -0400 Received: from [199.232.76.173] (port=48334 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LtJ7t-0006Bk-A2 for qemu-devel@nongnu.org; Mon, 13 Apr 2009 06:10:53 -0400 Received: from mx2.redhat.com ([66.187.237.31]:38588) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1LtJ7s-0006y9-Rc for qemu-devel@nongnu.org; Mon, 13 Apr 2009 06:10:53 -0400 From: Avi Kivity Date: Mon, 13 Apr 2009 13:10:47 +0300 Message-Id: <1239617447-4809-1-git-send-email-avi@redhat.com> Subject: [Qemu-devel] [PATCH] Fix vga segfaults or screen corruption with large memory guests Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org page0 and friends are ram addresses; a smaller size will overflow and cause a segfault or random corruption. Change them to ram_addr_t. Signed-off-by: Avi Kivity --- hw/vga.c | 11 ++++++----- 1 files changed, 6 insertions(+), 5 deletions(-) diff --git a/hw/vga.c b/hw/vga.c index b53b743..22edec1 100644 --- a/hw/vga.c +++ b/hw/vga.c @@ -1587,8 +1587,9 @@ static void vga_sync_dirty_bitmap(VGAState *s) */ static void vga_draw_graphic(VGAState *s, int full_update) { - int y1, y, update, page_min, page_max, linesize, y_start, double_scan, mask, depth; - int width, height, shift_control, line_offset, page0, page1, bwidth, bits; + int y1, y, update, linesize, y_start, double_scan, mask, depth; + int width, height, shift_control, line_offset, bwidth, bits; + ram_addr_t page0, page1, page_min, page_max; int disp_width, multi_scan, multi_run; uint8_t *d; uint32_t v, addr1, addr; @@ -1726,8 +1727,8 @@ static void vga_draw_graphic(VGAState *s, int full_update) addr1 = (s->start_addr * 4); bwidth = (width * bits + 7) / 8; y_start = -1; - page_min = 0x7fffffff; - page_max = -1; + page_min = -1; + page_max = 0; d = ds_get_data(s->ds); linesize = ds_get_linesize(s->ds); y1 = 0; @@ -1794,7 +1795,7 @@ static void vga_draw_graphic(VGAState *s, int full_update) disp_width, y - y_start); } /* reset modified pages */ - if (page_max != -1) { + if (page_max >= page_min) { cpu_physical_memory_reset_dirty(page_min, page_max + TARGET_PAGE_SIZE, VGA_DIRTY_FLAG); } -- 1.6.1.1