This set of patches fixes three bugs discovered recently in the sm501 device. They're all of the form "guest can misprogram registers in a way that defeats the bounds-checks on the 2D graphics ops".
thanks -- PMM Peter Maydell (3): hw/display/sm501: Catch bad coordinates for RTL operations hw/display/sm501: Avoid overflow problems in bounds check calculations hw/display/sm501: Don't allow guest to set ram size larger than it is hw/display/sm501.c | 64 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 55 insertions(+), 9 deletions(-) -- 2.43.0
