From: Li Qiang <liqiang...@360.cn>
When doing bitblt copy in backward mode, minus the blt width first
to avoid an oob access issue.
Signed-off-by: Li Qiang <liqiang...@360.cn>
---
hw/display/cirrus_vga.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 379910d..7ddd289 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -277,7 +277,8 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s,
}
if (pitch < 0) {
int64_t min = addr
- + ((int64_t)s->cirrus_blt_height-1) * pitch;
+ + ((int64_t)s->cirrus_blt_height-1) * pitch
+ - s->cirrus_blt_width;
int32_t max = addr
+ s->cirrus_blt_width;
if (min < 0 || max > s->vga.vram_size) {
--
1.8.3.1
