{"id":2221074,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2221074/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260408012853.2A9F15969F6@zero.eik.bme.hu/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/1.1/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260408012853.2A9F15969F6@zero.eik.bme.hu>","date":"2026-04-08T01:28:53","name":"ati-vga: Fix check for overflowing vram","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"c2bf65cf1305e3c9e90d120588f3cf66ac4ce1de","submitter":{"id":16148,"url":"http://patchwork.ozlabs.org/api/1.1/people/16148/?format=json","name":"BALATON Zoltan","email":"balaton@eik.bme.hu"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260408012853.2A9F15969F6@zero.eik.bme.hu/mbox/","series":[{"id":499188,"url":"http://patchwork.ozlabs.org/api/1.1/series/499188/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=499188","date":"2026-04-08T01:28:53","name":"ati-vga: Fix check for overflowing vram","version":1,"mbox":"http://patchwork.ozlabs.org/series/499188/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2221074/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2221074/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":"legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)","Received":["from lists.gnu.org (unknown [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frX9M68yQz1xy1\n\tfor ; Thu, 09 Apr 2026 04:47:02 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wAXsY-0000Yn-94; Wed, 08 Apr 2026 14:43:54 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wAXsW-0000Mq-CX\n for qemu-devel@nongnu.org; Wed, 08 Apr 2026 14:43:52 -0400","from zero.eik.bme.hu ([152.66.115.2])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wAHj2-0005ms-4h\n for qemu-devel@nongnu.org; Tue, 07 Apr 2026 21:29:02 -0400","from localhost (localhost [127.0.0.1])\n by zero.eik.bme.hu (Postfix) with ESMTP id 3BED55969EC;\n Wed, 08 Apr 2026 03:28:55 +0200 (CEST)","from zero.eik.bme.hu ([127.0.0.1])\n by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP\n id H8IWqafsHX5F; Wed, 8 Apr 2026 03:28:53 +0200 (CEST)","by zero.eik.bme.hu (Postfix, from userid 432)\n id 2A9F15969F6; Wed, 08 Apr 2026 03:28:53 +0200 (CEST)"],"X-Virus-Scanned":"amavis at eik.bme.hu","From":"BALATON Zoltan ","Subject":"[PATCH] ati-vga: Fix check for overflowing vram","MIME-Version":"1.0","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"8bit","To":"qemu-devel@nongnu.org","Cc":"Gerd Hoffmann , marcandre.lureau@redhat.com,\n Chad Jablonski ,\n =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= ,\n Peter Maydell ","Message-Id":"<20260408012853.2A9F15969F6@zero.eik.bme.hu>","Date":"Wed, 08 Apr 2026 03:28:53 +0200 (CEST)","Received-SPF":"pass client-ip=152.66.115.2; envelope-from=balaton@eik.bme.hu;\n helo=zero.eik.bme.hu","X-Spam_score_int":"-18","X-Spam_score":"-1.9","X-Spam_bar":"-","X-Spam_report":"(-1.9 / 5.0 requ) BAYES_00=-1.9,\n RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,\n SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"Take into account the bytes per pixels when checking for accessing\nbeyond end of vram area.\n\nSigned-off-by: BALATON Zoltan \n---\n hw/display/ati_2d.c | 7 +++----\n 1 file changed, 3 insertions(+), 4 deletions(-)","diff":"diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c\nindex f0f77cecc6..2450bb5e74 100644\n--- a/hw/display/ati_2d.c\n+++ b/hw/display/ati_2d.c\n@@ -146,6 +146,7 @@ static uint32_t make_filler(int bpp, uint32_t color)\n static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n {\n QemuRect vis_src, vis_dst;\n+ unsigned int x, y, i, j, bypp = ctx->bpp / 8;\n \n if (!ctx->bpp) {\n qemu_log_mask(LOG_GUEST_ERROR, \"Invalid bpp\\n\");\n@@ -156,7 +157,7 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n return false;\n }\n if (ctx->dst.x > 0x3fff || ctx->dst.y > 0x3fff ||\n- ctx->dst_bits >= ctx->vram_end || ctx->dst_bits + ctx->dst.x +\n+ ctx->dst_bits >= ctx->vram_end || ctx->dst_bits + ctx->dst.x * bypp +\n (ctx->dst.y + ctx->dst.height) * ctx->dst_stride >= ctx->vram_end) {\n qemu_log_mask(LOG_UNIMP, \"blt outside vram not implemented\\n\");\n return false;\n@@ -194,7 +195,7 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n }\n if (!ctx->host_data_active &&\n (vis_src.x > 0x3fff || vis_src.y > 0x3fff ||\n- ctx->src_bits >= ctx->vram_end || ctx->src_bits + vis_src.x +\n+ ctx->src_bits >= ctx->vram_end || ctx->src_bits + vis_src.x * bypp +\n (vis_src.y + vis_dst.height) * ctx->src_stride >= ctx->vram_end)) {\n qemu_log_mask(LOG_UNIMP, \"blt outside vram not implemented\\n\");\n return false;\n@@ -240,7 +241,6 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n fallback = true;\n }\n if (fallback) {\n- unsigned int y, i, j, bypp = ctx->bpp / 8;\n for (y = 0; y < vis_dst.height; y++) {\n i = vis_dst.x * bypp;\n j = vis_src.x * bypp;\n@@ -299,7 +299,6 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman)\n #endif\n {\n /* fallback when pixman failed or we don't want to call it */\n- unsigned int x, y, i, bypp = ctx->bpp / 8;\n for (y = 0; y < vis_dst.height; y++) {\n i = vis_dst.x * bypp + (vis_dst.y + y) * ctx->dst_stride;\n for (x = 0; x < vis_dst.width; x++, i += bypp) {\n","prefixes":[]}