vbox的更動 69097 路徑 trunk/src/VBox

時間撮記:

2017-10-17 上午07:11:33 (7 年 以前)

作者:

vboxsync

訊息:

DevVGA-SVGA.cpp: reduced code duplication, minor fixes.

檔案:

• trunk/src/VBox/Devices/Graphics/DevVGA-SVGA.cpp (修改) (4 筆差異)

trunk/src/VBox/Devices/Graphics/DevVGA-SVGA.cpp

@@ -3309 +3309 @@
                      pCursor->andMaskDepth, pCursor->xorMaskDepth));
                 AssertBreak(pCursor->height < 2048 && pCursor->width < 2048);
+                AssertBreak(pCursor->andMaskDepth <= 32);
+                AssertBreak(pCursor->xorMaskDepth <= 32);
 
                 uint32_t cbAndLine = RT_ALIGN_32(pCursor->width * (pCursor->andMaskDepth + (pCursor->andMaskDepth == 15)), 32) / 8;
@@ -3683 +3685 @@
                 if (height > pThis->svga.uHeight)
                     height = pThis->svga.uHeight;
+
+                /* srcOrigin */
+                AssertBreak(pSVGAState->GMRFB.bytesPerLine != 0);
+                AssertBreak(pSVGAState->GMRFB.format.s.bitsPerPixel != 0);
+
+                const uint32_t cScanlines = pThis->vram_size / pSVGAState->GMRFB.bytesPerLine;
+                AssertBreak(pCmd->srcOrigin.y < (int32_t)cScanlines);
+
+                AssertBreak(pCmd->srcOrigin.x < (int32_t)(pSVGAState->GMRFB.bytesPerLine / ((pSVGAState->GMRFB.format.s.bitsPerPixel + 7) / 8)));
 
                 unsigned offsetSource = (pCmd->srcOrigin.x * pSVGAState->GMRFB.format.s.bitsPerPixel) / 8 + pSVGAState->GMRFB.bytesPerLine * pCmd->srcOrigin.y;
@@ -4244 +4255 @@
     Assert(cbWidth && cHeight);
 
+    const uint32_t cbGmrScanline = cbSrcPitch > 0 ? cbSrcPitch : -cbSrcPitch;
+
+    uint32_t cbGmrTotal; /* The GMR size in bytes. */
+    if (src.gmrId == SVGA_GMR_FRAMEBUFFER)
+    {
+        pGMR = NULL;
+        cbGmrTotal = pThis->vram_size;
+    }
+    else
+    {
+        AssertReturn(src.gmrId < VMSVGA_MAX_GMR_IDS, VERR_INVALID_PARAMETER);
+        pGMR = &pSVGAState->aGMR[src.gmrId];
+        cbGmrTotal = pGMR->cbTotal;
+    }
+
+    /* Check GMR parameters */
+    AssertMsgReturn(src.offset < cbGmrTotal,
+                    ("src.gmrId=%#x src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x cbGmrTotal=%#x\n",
+                     src.gmrId, src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, cbGmrTotal),
+                    VERR_INVALID_PARAMETER);
+    AssertMsgReturn(offSrc < cbGmrTotal - src.offset,
+                    ("src.gmrId=%#x src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x cbGmrTotal=%#x\n",
+                     src.gmrId, src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, cbGmrTotal),
+                    VERR_INVALID_PARAMETER);
+    AssertMsgReturn(cbGmrScanline != 0,
+                    ("src.gmrId=%#x src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x cbGmrTotal=%#x\n",
+                     src.gmrId, src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, cbGmrTotal),
+                    VERR_INVALID_PARAMETER);
+    AssertMsgReturn(cbWidth <= cbGmrScanline,
+                    ("src.gmrId=%#x src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x cbGmrTotal=%#x\n",
+                     src.gmrId, src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, cbGmrTotal),
+                    VERR_INVALID_PARAMETER);
+
+    offSrc += src.offset; /* Actual offset in the GMR, where the first scanline will be copied. */
+
+    AssertMsgReturn(cbWidth <= cbGmrTotal - offSrc,
+                    ("src.gmrId=%#x src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x cbGmrTotal=%#x\n",
+                     src.gmrId, src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, cbGmrTotal),
+                    VERR_INVALID_PARAMETER);
+
+    uint32_t cbGmrLeft = cbSrcPitch > 0 ? cbGmrTotal - offSrc : offSrc + cbWidth;
+
+    uint32_t cGmrScanlines = cbGmrLeft / cbGmrScanline;
+    uint32_t cbLastScanline = cbGmrLeft - cGmrScanlines * cbGmrScanline; /* Slack space. */
+    if (cbWidth <= cbLastScanline)
+        ++cGmrScanlines;
+
+    if (cHeight > cGmrScanlines)
+        cHeight = cGmrScanlines;
+
+    AssertMsgReturn(cHeight > 0,
+                    ("src.gmrId=%#x src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x cbGmrTotal=%#x\n",
+                     src.gmrId, src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, cbGmrTotal),
+                    VERR_INVALID_PARAMETER);
+
     /* Shortcut for the framebuffer. */
     if (src.gmrId == SVGA_GMR_FRAMEBUFFER)
     {
-        offSrc += src.offset;
-        AssertMsgReturn(src.offset < pThis->vram_size,
-                        ("src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x vram_size=%#x\n",
-                         src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, pThis->vram_size),
-                        VERR_INVALID_PARAMETER);
-        AssertMsgReturn(offSrc + cbSrcPitch * (cHeight - 1) + cbWidth <= pThis->vram_size,
-                        ("src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x vram_size=%#x\n",
-                         src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, pThis->vram_size),
-                        VERR_INVALID_PARAMETER);
-
         uint8_t *pSrc  = pThis->CTX_SUFF(vram_ptr) + offSrc;
 
@@ -4291 +4347 @@
     }
 
-    AssertReturn(src.gmrId < VMSVGA_MAX_GMR_IDS, VERR_INVALID_PARAMETER);
-    pGMR   = &pSVGAState->aGMR[src.gmrId];
-    pDesc  = pGMR->paDesc;
-
-    offSrc += src.offset;
-    AssertMsgReturn(src.offset < pGMR->cbTotal,
-                    ("src.gmrId=%#x src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x cbTotal=%#x\n",
-                     src.gmrId, src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, pGMR->cbTotal),
-                    VERR_INVALID_PARAMETER);
-    AssertMsgReturn(offSrc + cbSrcPitch * (cHeight - 1) + cbWidth <= pGMR->cbTotal,
-                    ("src.gmrId=%#x src.offset=%#x offSrc=%#x cbSrcPitch=%#x cHeight=%#x cbWidth=%#x cbTotal=%#x\n",
-                     src.gmrId, src.offset, offSrc, cbSrcPitch, cHeight, cbWidth, pGMR->cbTotal),
-                    VERR_INVALID_PARAMETER);
+    AssertPtrReturn(pGMR, VERR_INVALID_PARAMETER);
+    pDesc = pGMR->paDesc;
 
     for (uint32_t i = 0; i < cHeight; i++)