On Tue, 16 Jun 2020 at 01:35, BALATON Zoltan <bala...@eik.bme.hu> wrote:
>
> Prevent guest setting invalid format value that might trip checks in
> sm501_2d_operation().
>
> Signed-off-by: BALATON Zoltan <bala...@eik.bme.hu>
> ---
>  hw/display/sm501.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/hw/display/sm501.c b/hw/display/sm501.c
> index 6e914d3162..583a0ff6b5 100644
> --- a/hw/display/sm501.c
> +++ b/hw/display/sm501.c
> @@ -1503,6 +1503,9 @@ static void sm501_2d_engine_write(void *opaque, hwaddr 
> addr,
>          s->twoD_background = value;
>          break;
>      case SM501_2D_STRETCH:
> +        if (((value >> 20) & 3) == 3) {
> +            value &= ~BIT(20);
> +        }
>          s->twoD_stretch = value;
>          break;
>      case SM501_2D_COLOR_COMPARE:
> --

Reviewed-by: Peter Maydell <peter.mayd...@linaro.org>

thanks
-- PMM

Reply via email to