cmd_data is int32_t, so a negative value (possible via crafted migration state) would produce a negative result from the modulo operator under C99 semantics. This would set col or row to a negative index, causing out-of-bounds framebuffer access.
Cast to uint32_t before the modulo to guarantee a non-negative result. Reported-by: Pavee Hui <[email protected]> Fixes: e7f76c521f4f ("vmstateify ssd0323 display") Signed-off-by: Marc-André Lureau <[email protected]> --- hw/display/ssd0323.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/display/ssd0323.c b/hw/display/ssd0323.c index 6172596abe6c..0a6f8cb686b3 100644 --- a/hw/display/ssd0323.c +++ b/hw/display/ssd0323.c @@ -113,13 +113,13 @@ static uint32_t ssd0323_transfer(SSIPeripheral *dev, uint32_t data) #define DATA(x) if (s->cmd_len <= (x)) return 0 case 0x15: /* Set column. */ DATA(2); - s->col = s->col_start = s->cmd_data[0] % 64; - s->col_end = s->cmd_data[1] % 64; + s->col = s->col_start = (uint32_t)s->cmd_data[0] % 64; + s->col_end = (uint32_t)s->cmd_data[1] % 64; break; case 0x75: /* Set row. */ DATA(2); - s->row = s->row_start = s->cmd_data[0] % 80; - s->row_end = s->cmd_data[1] % 80; + s->row = s->row_start = (uint32_t)s->cmd_data[0] % 80; + s->row_end = (uint32_t)s->cmd_data[1] % 80; break; case 0x81: /* Set contrast */ DATA(1); -- 2.56.0.rc0.29.g47ce80527c56
