console: Avoid overrunning the dmask arrays

The valide range of font_data should be [0, 0xFF].

Signed-off-by: Kaifeng Zhu <kaifeng.zhu@citrix.com>
(defects not identified by Coverity Scan)
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/console.c b/console.c
index 9984d6feedd652ee29ff25adb0690ea750f780e6..d4f1ad0e0657685ff5e92352359d85f285160fcb 100644 (file)
--- a/console.c
+++ b/console.c
@@ -421,7 +421,8 @@ static void vga_putcharxy(DisplayState *ds, int x, int y, int ch,
 {
     uint8_t *d;
     const uint8_t *font_ptr;
-    unsigned int font_data, linesize, xorcol, bpp;
+    uint8_t font_data;
+    unsigned int linesize, xorcol, bpp;
     int i;
     unsigned int fgcol, bgcol;
 
@@ -450,7 +451,7 @@ static void vga_putcharxy(DisplayState *ds, int x, int y, int ch,
             font_data = *font_ptr++;
             if (t_attrib->uline
                 && ((i == FONT_HEIGHT - 2) || (i == FONT_HEIGHT - 3))) {
-                font_data = 0xFFFF;
+                font_data = 0xFF;
             }
             ((uint32_t *)d)[0] = (dmask16[(font_data >> 4)] & xorcol) ^ bgcol;
             ((uint32_t *)d)[1] = (dmask16[(font_data >> 0) & 0xf] & xorcol) ^ bgcol;
@@ -463,7 +464,7 @@ static void vga_putcharxy(DisplayState *ds, int x, int y, int ch,
             font_data = *font_ptr++;
             if (t_attrib->uline
                 && ((i == FONT_HEIGHT - 2) || (i == FONT_HEIGHT - 3))) {
-                font_data = 0xFFFF;
+                font_data = 0xFF;
             }
             ((uint32_t *)d)[0] = (dmask4[(font_data >> 6)] & xorcol) ^ bgcol;
             ((uint32_t *)d)[1] = (dmask4[(font_data >> 4) & 3] & xorcol) ^ bgcol;
@@ -476,7 +477,7 @@ static void vga_putcharxy(DisplayState *ds, int x, int y, int ch,
         for(i = 0; i < FONT_HEIGHT; i++) {
             font_data = *font_ptr++;
             if (t_attrib->uline && ((i == FONT_HEIGHT - 2) || (i == FONT_HEIGHT - 3))) {
-                font_data = 0xFFFF;
+                font_data = 0xFF;
             }
             ((uint32_t *)d)[0] = (-((font_data >> 7)) & xorcol) ^ bgcol;
             ((uint32_t *)d)[1] = (-((font_data >> 6) & 1) & xorcol) ^ bgcol;