Re: [Qemu-devel] [PATCH] cirrus: fix oob access issue

[Gerd Hoffmann]

> > diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
> > index 379910d..7ddd289 100644
> > --- a/hw/display/cirrus_vga.c
> > +++ b/hw/display/cirrus_vga.c
> > @@ -277,7 +277,8 @@ static bool blit_region_is_unsafe(struct CirrusVGAState 
> > *s,
> >      }
> >      if (pitch < 0) {
> >          int64_t min = addr
> > -            + ((int64_t)s->cirrus_blt_height-1) * pitch;
> > +            + ((int64_t)s->cirrus_blt_height-1) * pitch
> > +            - s->cirrus_blt_width;
> >          int32_t max = addr
> >              + s->cirrus_blt_width;
> >          if (min < 0 || max > s->vga.vram_size) {
> > 
> 
> I believe this is incorrect. In this case (AFAIR), "addr" points to the
> left-most pixel (= lowest address) of the bottom line (= highest
> address).

If I read the code correctly it is backwards *both* x and y axis, so
addr is the right-most pixel of the bottom line.

cheers,
  Gerd