motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-27 03:51:57 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

macfb: fix overflow of color_palette array

Browse source 
The palette_current index counter has a maximum size of 256 * 3 to cover a full
color palette of 256 RGB entries. Linux assumes that the palette_current index
wraps back around to zero after writing 256 RGB entries so ensure that
palette_current is reset at this point to prevent data corruption within
MacfbState.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20211007221253.29024-5-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
This commit is contained in:
Mark Cave-Ayland 2021-10-07 23:12:44 +01:00 • committed by Laurent Vivier
parent 906c2323f1
commit 14d0ddfce7
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hw/display/macfb.c
View file

@ -303,7 +303,9 @@ static void macfb_ctrl_write(void *opaque,
s->palette_current = 0; s->palette_current = 0;
break; break;
case DAFB_LUT: case DAFB_LUT:
s->color_palette[s->palette_current++] = val; s->color_palette[s->palette_current] = val;
s->palette_current = (s->palette_current + 1) %
ARRAY_SIZE(s->color_palette);
if (s->palette_current % 3) { if (s->palette_current % 3) {
macfb_invalidate_display(s); macfb_invalidate_display(s);
} }