diff mbox series

[PULL,07/13] sm501: Do not allow guest to set invalid format

Message ID 20200701150425.13739-8-kraxel@redhat.com (mailing list archive)
State New, archived
Headers show
Series [PULL,01/13] sm501: Fix bounds checks | expand

Commit Message

Gerd Hoffmann July 1, 2020, 3:04 p.m. UTC 
From: BALATON Zoltan <balaton@eik.bme.hu>

Prevent guest setting invalid format value that might trip checks in
sm501_2d_operation().

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 26d4fa9b8ce81e2723e98d592ccba7550042752c.1592686588.git.balaton@eik.bme.hu
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/sm501.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 6349f31e6491..7e4c042d5229 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -1503,6 +1503,9 @@  static void sm501_2d_engine_write(void *opaque, hwaddr addr,
         s->twoD_background = value;
         break;
     case SM501_2D_STRETCH:
+        if (((value >> 20) & 3) == 3) {
+            value &= ~BIT(20);
+        }
         s->twoD_stretch = value;
         break;
     case SM501_2D_COLOR_COMPARE: