| Message ID | 40f83f54bd3a4aad12212bbcd73d5466451df38a.1592266950.git.balaton@eik.bme.hu (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | More sm501 fixes and optimisations | expand |
On Tue, 16 Jun 2020 at 01:35, BALATON Zoltan <balaton@eik.bme.hu> wrote: > > Prevent guest setting invalid format value that might trip checks in > sm501_2d_operation(). > > Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> > --- > hw/display/sm501.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/hw/display/sm501.c b/hw/display/sm501.c > index 6e914d3162..583a0ff6b5 100644 > --- a/hw/display/sm501.c > +++ b/hw/display/sm501.c > @@ -1503,6 +1503,9 @@ static void sm501_2d_engine_write(void *opaque, hwaddr addr, > s->twoD_background = value; > break; > case SM501_2D_STRETCH: > + if (((value >> 20) & 3) == 3) { > + value &= ~BIT(20); > + } > s->twoD_stretch = value; > break; > case SM501_2D_COLOR_COMPARE: > -- Reviewed-by: Peter Maydell <peter.maydell@linaro.org> thanks -- PMM
diff --git a/hw/display/sm501.c b/hw/display/sm501.c index 6e914d3162..583a0ff6b5 100644 --- a/hw/display/sm501.c +++ b/hw/display/sm501.c @@ -1503,6 +1503,9 @@ static void sm501_2d_engine_write(void *opaque, hwaddr addr, s->twoD_background = value; break; case SM501_2D_STRETCH: + if (((value >> 20) & 3) == 3) { + value &= ~BIT(20); + } s->twoD_stretch = value; break; case SM501_2D_COLOR_COMPARE:
Prevent guest setting invalid format value that might trip checks in sm501_2d_operation(). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> --- hw/display/sm501.c | 3 +++ 1 file changed, 3 insertions(+)