diff mbox series

[v2,7/8] sm501: Do not allow guest to set invalid format

Message ID 40f83f54bd3a4aad12212bbcd73d5466451df38a.1592266950.git.balaton@eik.bme.hu
State New
Headers show
Series More sm501 fixes and optimisations | expand

Commit Message

BALATON Zoltan June 16, 2020, 12:22 a.m. UTC
Prevent guest setting invalid format value that might trip checks in
sm501_2d_operation().

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
---
 hw/display/sm501.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Peter Maydell June 18, 2020, 4:43 p.m. UTC | #1
On Tue, 16 Jun 2020 at 01:35, BALATON Zoltan <balaton@eik.bme.hu> wrote:
>
> Prevent guest setting invalid format value that might trip checks in
> sm501_2d_operation().
>
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> ---
>  hw/display/sm501.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/hw/display/sm501.c b/hw/display/sm501.c
> index 6e914d3162..583a0ff6b5 100644
> --- a/hw/display/sm501.c
> +++ b/hw/display/sm501.c
> @@ -1503,6 +1503,9 @@ static void sm501_2d_engine_write(void *opaque, hwaddr addr,
>          s->twoD_background = value;
>          break;
>      case SM501_2D_STRETCH:
> +        if (((value >> 20) & 3) == 3) {
> +            value &= ~BIT(20);
> +        }
>          s->twoD_stretch = value;
>          break;
>      case SM501_2D_COLOR_COMPARE:
> --

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM
diff mbox series

Patch

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 6e914d3162..583a0ff6b5 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -1503,6 +1503,9 @@  static void sm501_2d_engine_write(void *opaque, hwaddr addr,
         s->twoD_background = value;
         break;
     case SM501_2D_STRETCH:
+        if (((value >> 20) & 3) == 3) {
+            value &= ~BIT(20);
+        }
         s->twoD_stretch = value;
         break;
     case SM501_2D_COLOR_COMPARE: