From 819c83e27895472befbfee67d3d7d089c61d7fbd Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 29 Apr 2020 13:52:35 +0200 Subject: [PATCH] ramfb: add sanity checks to ramfb_create_display_surface Signed-off-by: Gerd Hoffmann Reviewed-by: Laszlo Ersek Message-id: 20200429115236.28709-6-kraxel@redhat.com --- hw/display/ramfb.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c index 1a20bdec41..52dae78db4 100644 --- a/hw/display/ramfb.c +++ b/hw/display/ramfb.c @@ -15,6 +15,7 @@ #include "qapi/error.h" #include "hw/loader.h" #include "hw/display/ramfb.h" +#include "hw/display/bochs-vbe.h" /* for limits */ #include "ui/console.h" #include "sysemu/reset.h" @@ -49,6 +50,11 @@ static DisplaySurface *ramfb_create_display_surface(int width, int height, hwaddr size; void *data; + if (width < 16 || width > VBE_DISPI_MAX_XRES || + height < 16 || height > VBE_DISPI_MAX_YRES || + format == 0 /* unknown format */) + return NULL; + if (linesize == 0) { linesize = width * PIXMAN_FORMAT_BPP(format) / 8; }