ati-vga: Fix checks in ati_2d_blt() to avoid crash

In some corner cases (that never happen during normal operation but a
malicious guest could program wrong values) pixman functions were
called with parameters that result in a crash. Fix this and add more
checks to disallow such cases.

Reported-by: Ziming Zhang <>
Signed-off-by: BALATON Zoltan <>
Signed-off-by: Gerd Hoffmann <>
1 file changed