cirrusfb division by zero

Anthony,

The following sequence crashes F9 guests, when using VNC:

# modprobe cirrusfb
# vbetool post

Results in Floating point exception at:

cirrus_do_copy()
{

    depth = s->get_bpp((VGAState *)s) / 8 
    ...
    sx = (src % (width * depth)) / depth;
    ...
}

Problem is that ->get_bpp returns 0.

Following band-aid "fixes it" (coff). I have no idea if its correct though ?

"vbetool post" corrupts both SDL and VNC displays when using cirrusfb, but seems a separate problem.

index e14ec35..9f860ff 100644
@@ -709,6 +709,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, in     int notify = 0;
 
     depth = s->get_bpp((VGAState *)s) / 8;
+    if (!depth)
+        depth = 1;
     s->get_resolution((VGAState *)s, &width, &height);
 
     /* extra x, y */
 

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

It suggests something is very broken. get_bpp only is supposed to return 0 when in VGA mode. I don't think blitting should happen when in VGA mode. Applying the patch is not a bad idea but what was the guest doing when this happened? Was it in the process of transitioning from one mode to another?

Regards,

Anthony Liguori