diff mbox

display: vga: add check to limit display width

Message ID 1461658058-1672-1-git-send-email-ppandit@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Prasad Pandit April 26, 2016, 8:07 a.m. UTC 
From: Prasad J Pandit <pjp@fedoraproject.org>

In vga_draw_graphic, display width could exceed the maximum
range of VBE_DISPI_MAX_XRES(16000). This could lead to possible
integer overflows. Add check to avoid it.

Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/display/vga.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox

Patch

diff --git a/hw/display/vga.c b/hw/display/vga.c
index 9f68394..1a66291 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -1478,6 +1478,9 @@  static void vga_draw_graphic(VGACommonState *s, int full_update)
             disp_width <<= 1;
         }
     }
+    if (disp_width > VBE_DISPI_MAX_XRES) {
+        disp_width = VBE_DISPI_MAX_XRES;
+    }
 
     depth = s->get_bpp(s);