[{"id":3674953,"web_url":"http://patchwork.ozlabs.org/comment/3674953/","msgid":"","list_archive_url":null,"date":"2026-04-08T18:56:56","subject":"Re: [PATCH] ati-vga: Fix check for overflowing vram","submitter":{"id":66774,"url":"http://patchwork.ozlabs.org/api/people/66774/","name":"Marc-André Lureau","email":"marcandre.lureau@redhat.com"},"content":"On Wed, Apr 8, 2026 at 5:29 AM BALATON Zoltan wrote:\n>\n> Take into account the bytes per pixels when checking for accessing\n> beyond end of vram area.\n>\n> Signed-off-by: BALATON Zoltan \n\nReviewed-by: Marc-André Lureau \n\n> ---\n> hw/display/ati_2d.c | 7 +++----\n> 1 file changed, 3 insertions(+), 4 deletions(-)\n>\n> diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c\n> index f0f77cecc6..2450bb5e74 100644\n> --- a/hw/display/ati_2d.c\n> +++ b/hw/display/ati_2d.c\n> @@ -146,6 +146,7 @@ static uint32_t make_filler(int bpp, uint32_t color)\n> static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n> {\n> QemuRect vis_src, vis_dst;\n> + unsigned int x, y, i, j, bypp = ctx->bpp / 8;\n>\n> if (!ctx->bpp) {\n> qemu_log_mask(LOG_GUEST_ERROR, \"Invalid bpp\\n\");\n> @@ -156,7 +157,7 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n> return false;\n> }\n> if (ctx->dst.x > 0x3fff || ctx->dst.y > 0x3fff ||\n> - ctx->dst_bits >= ctx->vram_end || ctx->dst_bits + ctx->dst.x +\n> + ctx->dst_bits >= ctx->vram_end || ctx->dst_bits + ctx->dst.x * bypp +\n> (ctx->dst.y + ctx->dst.height) * ctx->dst_stride >= ctx->vram_end) {\n> qemu_log_mask(LOG_UNIMP, \"blt outside vram not implemented\\n\");\n> return false;\n> @@ -194,7 +195,7 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n> }\n> if (!ctx->host_data_active &&\n> (vis_src.x > 0x3fff || vis_src.y > 0x3fff ||\n> - ctx->src_bits >= ctx->vram_end || ctx->src_bits + vis_src.x +\n> + ctx->src_bits >= ctx->vram_end || ctx->src_bits + vis_src.x * bypp +\n> (vis_src.y + vis_dst.height) * ctx->src_stride >= ctx->vram_end)) {\n> qemu_log_mask(LOG_UNIMP, \"blt outside vram not implemented\\n\");\n> return false;\n> @@ -240,7 +241,6 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n> fallback = true;\n> }\n> if (fallback) {\n> - unsigned int y, i, j, bypp = ctx->bpp / 8;\n> for (y = 0; y < vis_dst.height; y++) {\n> i = vis_dst.x * bypp;\n> j = vis_src.x * bypp;\n> @@ -299,7 +299,6 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n> #endif\n> {\n> /* fallback when pixman failed or we don't want to call it */\n> - unsigned int x, y, i, bypp = ctx->bpp / 8;\n> for (y = 0; y < vis_dst.height; y++) {\n> i = vis_dst.x * bypp + (vis_dst.y + y) * ctx->dst_stride;\n> for (x = 0; x < vis_dst.width; x++, i += bypp) {\n> --\n> 2.41.3\n>","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=Z15SMdJf;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=google header.b=adFTYp73;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frYCV50bnz1xv0\n\tfor ; Thu, 09 Apr 2026 05:33:58 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wAYVq-0004sI-Ud; Wed, 08 Apr 2026 15:24:31 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wAY5X-0006qq-8E\n for qemu-devel@nongnu.org; Wed, 08 Apr 2026 14:57:22 -0400","from us-smtp-delivery-124.mimecast.com ([170.10.129.124])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wAY5V-0002rB-A6\n for qemu-devel@nongnu.org; Wed, 08 Apr 2026 14:57:19 -0400","from mail-pj1-f70.google.com (mail-pj1-f70.google.com\n [209.85.216.70]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-311-iIAdiWLAN6O_gEKrWvZuvg-1; Wed, 08 Apr 2026 14:57:11 -0400","by mail-pj1-f70.google.com with SMTP id\n 98e67ed59e1d1-35d9467e85aso161010a91.0\n for ; Wed, 08 Apr 2026 11:57:11 -0700 (PDT)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1775674634;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=STqray6qmWsFx97R5S9epAo+2Fo0qs+i07qxUyJhsl4=;\n b=Z15SMdJfo5Jaw0klLr8mwPWPbjpZ+ENXj106Eo3CmAuLnh8O9GtJIrxWgnKjdW6iKGFuqy\n gWKLnit+8rsTrzRF2D9nuD+36k2ivX4aBPwKCZiHET7flWdNlNly4ofjEDP0+mYAOq7uwv\n drQdBoaLKIRNBUZJcReavaV/dkXcWB0=","v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=redhat.com; s=google; t=1775674630; x=1776279430; darn=nongnu.org;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:from:to:cc:subject:date\n :message-id:reply-to;\n bh=STqray6qmWsFx97R5S9epAo+2Fo0qs+i07qxUyJhsl4=;\n b=adFTYp73FMlNuwZAI6dyi3jDrZOmGBgKoETL98fpcukcfi+5brpEHqEqMAIZ3lA8t8\n oidcwyS7ute10DnSS6UB2OroAOboFvpAVjeOBjlz+u3q0iYlgk5nicIOfF5vZjtWJLjZ\n jCHBMFjX15OPzE8Esk5IpSPcWYNRAAWm+gohJ6bJT6EnswFpI+BVMe6+KAlqViE6WjR/\n 3N5kqKhRStoHM31BjGlwmDMAlgf7IAnfgHBB7uI8Qhgj8itYGNy9UvujUaueWkm5oAxS\n RSC8MIMaHhu/dEWf4HlAhlSlrZyeuHtxyCzveIRiJL7UqKgWdE5XXognqpF/WF1nUY8Y\n Tj1w=="],"X-MC-Unique":"iIAdiWLAN6O_gEKrWvZuvg-1","X-Mimecast-MFC-AGG-ID":"iIAdiWLAN6O_gEKrWvZuvg_1775674630","ARC-Seal":"i=1; a=rsa-sha256; t=1775674630; cv=none;\n d=google.com; s=arc-20240605;\n b=QJoglMi9/4KefqWfTV+5vF0D0n4C03wCDaRwV1CDGe/V7Qnvx6YqxIlAGkuCe9xP1x\n YhT8itk/oHayLDoR/nQHqR99wCpwGIIZ/kk5OhfYjdVGDHwrVXhliWkQolEGvaVNZpzq\n WuWViW+OLn4XifqdJwjGZUcDX9gZ/wrx243gww0/HyUfctUOwrdq4utKxwKfcVQGjpY2\n 2PFmWD1ZQLWvsp9Qr1hfgvmYxZPPsnQdlXuoo2lg7HsIZWpw24+d2QooGe3o8p2/1vld\n KSVNp4u/I5KuiSRVGmBG9hGAF4VH1G8a/4p9vTr48Jx6MeMnQaD6CN7hFZzhRyl6i+jk\n ww7g==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;\n s=arc-20240605;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:dkim-signature;\n bh=STqray6qmWsFx97R5S9epAo+2Fo0qs+i07qxUyJhsl4=;\n fh=luLSmtlXKCOv5SwkeC/BxKiqDDjS9e8bilKSx6CLRyk=;\n b=Rq3kDMazc4ReiTcqKyh4TWElXqrm2XUb92Fbb86u9hS6W5hZ7reKTsnjaE1RIGNiAx\n GDBECUJG0iaXMRDL3YbuaTj4DZ4SCD7W71jC9LuXs4A5ZTNVJIeV8IItaV92GI3HHLDh\n CeVBCP6/e0PeSU8Ux6BaMZiDTsOnL+JlEc+cvJqv6TPRjucTjAlgMRYYaj0hsYx5CN88\n dw4/X6ExhpCEvqjVwycYUxRL6r9ImvYzVKzfXJlS6bOFhYsO9nCiVRY6rOy63g09IaDM\n J55I2ulEi6EWvgufVSCE9SKkKrZlBw7vnADI6FORlFvhAWVlH8TM7AUwEpcGVXhnVlap\n 9YrQ==; darn=nongnu.org","ARC-Authentication-Results":"i=1; mx.google.com; arc=none","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775674630; x=1776279430;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=STqray6qmWsFx97R5S9epAo+2Fo0qs+i07qxUyJhsl4=;\n b=j05G9YRq7y/p0BW+hZOvklsYbK3VBd8ulItGgPHw39MLumryEK/7cdlTl0fIPSFtwR\n Zk4OFXvBMo8tQvJEZDX8gYpvNn325VbRHJGgMIAMcKbH0FvbCdNgq+R+MomFkT+kIrXk\n 22nVJf+ACsvv9wIkGkM05FlXn8iMOr31iavooImMaO1Fo2bvoUAxv2rEAyjNd6XOtiWD\n OSurBHpHdHRlqLoLmEI0ohs4Hc5Bqrj2yInXrZ9LcjXY46rceTd7GfLRYvxroBXH0+Xq\n IKGMCM9+55HdOMB4YJWXYPW4SIfLofKZj/q0ZEwc1si4eA7yUKccGaYTXA2d1949M1e0\n CCjw==","X-Gm-Message-State":"AOJu0Yx+glP8+Xi+ouO9qaT5af844Rb9uzGmhKVJvplfhwakL6yAs0Qr\n 908tC8oe5EM28TETMuaGfG8mCIS3hHJnJba2RL+VCm+AUB5RtQ/vArPlEh/mh+7S2wa1eq9mrOb\n JTIot/hHG3y+Y/F4ZNcBYIlIACUAmuYDp3YhrotG70dcaERnf6s2OFm00kCBMj9e6jPTHroIcWC\n 3AlCFdkThoMkWEMqz6TiDCrjAvtEPZGcE=","X-Gm-Gg":"AeBDietA/XFBefcD5W516Q8u951xqLf+LFM4Rnt3taQacHFc+jIWy8JH8HEnytNvhKj\n 99WP9wAZyD+fLv3IJbVERtFSGopCMyBA5l+gWz32aWT5M8qZAtYiyNRnfnM1U6J4G5TdmGYHOzk\n ZgTwaR2RdcFurKekt5eIoxNjuNl+VFLItu8bsS/78WLCpnY8/zsIwI1TP/3jTDGCEas1E08+lH9\n TBVWympga4k8cC4cGbW1PIheGRX3BpYT1Q+4yZ9v1iP451K+Z0CNdQhMyfr/woXMAx6QG6+RYJh\n oXaGP+WQGYyDMJYvJegqkl4=","X-Received":["by 2002:a17:90b:3b8a:b0:35d:8e4d:23a8 with SMTP id\n 98e67ed59e1d1-35de68f8b42mr20371995a91.15.1775674630022;\n Wed, 08 Apr 2026 11:57:10 -0700 (PDT)","by 2002:a17:90b:3b8a:b0:35d:8e4d:23a8 with SMTP id\n 98e67ed59e1d1-35de68f8b42mr20371975a91.15.1775674629493; Wed, 08 Apr 2026\n 11:57:09 -0700 (PDT)"],"MIME-Version":"1.0","References":"<20260408012853.2A9F15969F6@zero.eik.bme.hu>","In-Reply-To":"<20260408012853.2A9F15969F6@zero.eik.bme.hu>","From":"=?utf-8?q?Marc-Andr=C3=A9_Lureau?= ","Date":"Wed, 8 Apr 2026 22:56:56 +0400","X-Gm-Features":"AQROBzAV6pFQyVJnNqNhsPsgW-8VULJaVqnwrKIgBhwt1VZG5U3yuuqHvW78jt8","Message-ID":"\n ","Subject":"Re: [PATCH] ati-vga: Fix check for overflowing vram","To":"BALATON Zoltan ","Cc":"qemu-devel@nongnu.org, Gerd Hoffmann ,\n Chad Jablonski ,\n =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= ,\n Peter Maydell ","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable","Received-SPF":"pass client-ip=170.10.129.124; envelope-from=mlureau@redhat.com;\n helo=us-smtp-delivery-124.mimecast.com","X-Spam_score_int":"-25","X-Spam_score":"-2.6","X-Spam_bar":"--","X-Spam_report":"(-2.6 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.54,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,\n RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,\n SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"}}]