From 081ddf9d66155dbec8ec064d7671ba0799642fd6 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Mon, 27 Mar 2017 10:01:22 +0200 Subject: [PATCH 7/7] cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Gerd Hoffmann Message-id: <1490608882-10242-8-git-send-email-kraxel@redhat.com> Patchwork-id: 74555 O-Subject: [RHEL-7.4 qemu-kvm PATCH v2 7/7] cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16 Bugzilla: 1430060 RH-Acked-by: Dr. David Alan Gilbert RH-Acked-by: Laurent Vivier RH-Acked-by: Paolo Bonzini The switch from pointers to addresses (commit 026aeffcb4752054830ba203020ed6eb05bcaba8 and ffaf857778286ca54e3804432a2369a279e73aa7) added a off-by-one bug to 16bit backward blits. Fix. Reported-by: 李强 Signed-off-by: Gerd Hoffmann Reviewed-by: Li Qiang Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com (cherry picked from commit f019722cbbb45aea153294fc8921fcc96a4d3fa2) Signed-off-by: Miroslav Rezanina --- hw/display/cirrus_vga_rop.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/display/cirrus_vga_rop.h b/hw/display/cirrus_vga_rop.h index 16dffb8..c1fc070 100644 --- a/hw/display/cirrus_vga_rop.h +++ b/hw/display/cirrus_vga_rop.h @@ -220,7 +220,7 @@ glue(glue(cirrus_bitblt_rop_bkwd_transp_, ROP_NAME),_16)(CirrusVGAState *s, srcpitch += bltwidth; for (y = 0; y < bltheight; y++) { for (x = 0; x < bltwidth; x+=2) { - ROP_OP_TR_16(s, dstaddr, cirrus_src16(s, srcaddr), transp); + ROP_OP_TR_16(s, dstaddr - 1, cirrus_src16(s, srcaddr - 1), transp); dstaddr -= 2; srcaddr -= 2; } -- 1.8.3.1