diff mbox series

[v2,03/12] macfb: fix overflow of color_palette array

Message ID 20211004211928.15803-4-mark.cave-ayland@ilande.co.uk
State New
Headers show
Series macfb: fixes for booting MacOS | expand

Commit Message

Mark Cave-Ayland Oct. 4, 2021, 9:19 p.m. UTC 
The palette_current index counter has a maximum size of 256 * 3 to cover a full
color palette of 256 RGB entries. Linux assumes that the palette_current index
wraps back around to zero after writing 256 RGB entries so ensure that
palette_current is reset at this point to prevent data corruption within
MacfbState.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 hw/display/macfb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Laurent Vivier Oct. 5, 2021, 6:34 a.m. UTC | #1 
Le 04/10/2021 à 23:19, Mark Cave-Ayland a écrit :
> The palette_current index counter has a maximum size of 256 * 3 to cover a full
> color palette of 256 RGB entries. Linux assumes that the palette_current index
> wraps back around to zero after writing 256 RGB entries so ensure that
> palette_current is reset at this point to prevent data corruption within
> MacfbState.
> 
> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
> ---
>  hw/display/macfb.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/display/macfb.c b/hw/display/macfb.c
> index b363bab889..39dab49026 100644
> --- a/hw/display/macfb.c
> +++ b/hw/display/macfb.c
> @@ -303,7 +303,9 @@ static void macfb_ctrl_write(void *opaque,
>          s->palette_current = 0;
>          break;
>      case DAFB_LUT:
> -        s->color_palette[s->palette_current++] = val;
> +        s->color_palette[s->palette_current] = val;
> +        s->palette_current = (s->palette_current + 1) %
> +                             ARRAY_SIZE(s->color_palette);
>          if (s->palette_current % 3) {
>              macfb_invalidate_display(s);
>          }
> 

Reviewed-by: Laurent Vivier <laurent@vivier.eu>
diff mbox series

Patch

diff --git a/hw/display/macfb.c b/hw/display/macfb.c
index b363bab889..39dab49026 100644
--- a/hw/display/macfb.c
+++ b/hw/display/macfb.c
@@ -303,7 +303,9 @@  static void macfb_ctrl_write(void *opaque,
         s->palette_current = 0;
         break;
     case DAFB_LUT:
-        s->color_palette[s->palette_current++] = val;
+        s->color_palette[s->palette_current] = val;
+        s->palette_current = (s->palette_current + 1) %
+                             ARRAY_SIZE(s->color_palette);
         if (s->palette_current % 3) {
             macfb_invalidate_display(s);
         }