diff mbox series

ati-vga: Fix indexed access to video memory

Message ID 20190318223842.427CB7456B2@zero.eik.bme.hu
State New
Headers show
Series ati-vga: Fix indexed access to video memory | expand

Commit Message

BALATON Zoltan March 18, 2019, 10:34 p.m. UTC 
Coverity (CID 1399700) found that this was wrong so instead of trying
to do it by hand use existing access functions that should work better.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
---
 hw/display/ati.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

Comments

Gerd Hoffmann March 26, 2019, 11:07 a.m. UTC | #1 
On Mon, Mar 18, 2019 at 11:34:46PM +0100, BALATON Zoltan wrote:
> Coverity (CID 1399700) found that this was wrong so instead of trying
> to do it by hand use existing access functions that should work better.

Added to patch queue.

thanks,
  Gerd
diff mbox series

Patch

diff --git a/hw/display/ati.c b/hw/display/ati.c
index 055cc69e16..b88309af63 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -236,12 +236,9 @@  static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
     case MM_DATA ... MM_DATA + 3:
         /* indexed access to regs or memory */
         if (s->regs.mm_index & BIT(31)) {
-            if (s->regs.mm_index <= s->vga.vram_size - size) {
-                int i = size - 1;
-                while (i >= 0) {
-                    val <<= 8;
-                    val |= s->vga.vram_ptr[s->regs.mm_index + i--];
-                }
+            uint32_t idx = s->regs.mm_index & ~BIT(31);
+            if (idx <= s->vga.vram_size - size) {
+                val = ldn_le_p(s->vga.vram_ptr + idx, size);
             }
         } else {
             val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size);
@@ -440,12 +437,9 @@  static void ati_mm_write(void *opaque, hwaddr addr,
     case MM_DATA ... MM_DATA + 3:
         /* indexed access to regs or memory */
         if (s->regs.mm_index & BIT(31)) {
-            if (s->regs.mm_index <= s->vga.vram_size - size) {
-                int i = 0;
-                while (i < size) {
-                    s->vga.vram_ptr[s->regs.mm_index + i] = data & 0xff;
-                    data >>= 8;
-                }
+            uint32_t idx = s->regs.mm_index & ~BIT(31);
+            if (idx <= s->vga.vram_size - size) {
+                stn_le_p(s->vga.vram_ptr + idx, size, data);
             }
         } else {
             ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size);