From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LyOVJ-00088j-Vz for qemu-devel@nongnu.org; Mon, 27 Apr 2009 06:56:06 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LyOVF-00087s-Qb for qemu-devel@nongnu.org; Mon, 27 Apr 2009 06:56:05 -0400 Received: from [199.232.76.173] (port=53197 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LyOVF-00087j-NH for qemu-devel@nongnu.org; Mon, 27 Apr 2009 06:56:01 -0400 Received: from mx2.redhat.com ([66.187.237.31]:51382) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1LyOVF-0007Z0-9E for qemu-devel@nongnu.org; Mon, 27 Apr 2009 06:56:01 -0400 From: Avi Kivity Date: Mon, 27 Apr 2009 13:55:54 +0300 Message-Id: <1240829754-20469-1-git-send-email-avi@redhat.com> Subject: [Qemu-devel] [PATCH][RESEND] Fix vga segfaults or screen corruption with large memory guests List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: qemu-devel@nongnu.org page0 and friends are ram addresses; a smaller size will overflow and cause a segfault or random corruption. Change them to ram_addr_t. Signed-off-by: Avi Kivity --- hw/vga.c | 11 ++++++----- 1 files changed, 6 insertions(+), 5 deletions(-) diff --git a/hw/vga.c b/hw/vga.c index 2f122ee..517ce3d 100644 --- a/hw/vga.c +++ b/hw/vga.c @@ -1584,8 +1584,9 @@ static void vga_sync_dirty_bitmap(VGAState *s) */ static void vga_draw_graphic(VGAState *s, int full_update) { - int y1, y, update, page_min, page_max, linesize, y_start, double_scan, mask, depth; - int width, height, shift_control, line_offset, page0, page1, bwidth, bits; + int y1, y, update, linesize, y_start, double_scan, mask, depth; + int width, height, shift_control, line_offset, bwidth, bits; + ram_addr_t page0, page1, page_min, page_max; int disp_width, multi_scan, multi_run; uint8_t *d; uint32_t v, addr1, addr; @@ -1723,8 +1724,8 @@ static void vga_draw_graphic(VGAState *s, int full_update) addr1 = (s->start_addr * 4); bwidth = (width * bits + 7) / 8; y_start = -1; - page_min = 0x7fffffff; - page_max = -1; + page_min = -1; + page_max = 0; d = ds_get_data(s->ds); linesize = ds_get_linesize(s->ds); y1 = 0; @@ -1791,7 +1792,7 @@ static void vga_draw_graphic(VGAState *s, int full_update) disp_width, y - y_start); } /* reset modified pages */ - if (page_max != -1) { + if (page_max >= page_min) { cpu_physical_memory_reset_dirty(page_min, page_max + TARGET_PAGE_SIZE, VGA_DIRTY_FLAG); } -- 1.6.1.1