From: Aleksandar Andrejevic <aandrejevic@reactos.org>
Date: Sat, 18 Apr 2015 04:21:28 +0000 (+0000)
Subject: [NTVDM]
X-Git-Tag: backups/colins-printing-for-freedom@73041~378
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=6381155e6c2c4596076509536fbdc124dfb93694;ds=sidebyside

[NTVDM]
Fix the range check in VgaReadMemory and VgaWriteMemory.


svn path=/trunk/; revision=67238
---

diff --git a/reactos/subsystems/mvdm/ntvdm/hardware/video/vga.c b/reactos/subsystems/mvdm/ntvdm/hardware/video/vga.c
index d4b39e97a92..079499c33b5 100644
--- a/reactos/subsystems/mvdm/ntvdm/hardware/video/vga.c
+++ b/reactos/subsystems/mvdm/ntvdm/hardware/video/vga.c
@@ -1910,7 +1910,7 @@ VOID NTAPI VgaReadMemory(ULONG Address, PVOID Buffer, ULONG Size)
     PUCHAR BufPtr = (PUCHAR)Buffer;
 
     DPRINT("VgaReadMemory: Address 0x%08X, Size %lu\n", Address, Size);
-    Address = max(min(Address, VgaGetVideoLimitAddress() - 1), VgaGetVideoBaseAddress());
+    Address = min(max(Address, VgaGetVideoLimitAddress() - 1), VgaGetVideoBaseAddress());
     Size = min(Size, VgaGetVideoLimitAddress() - Address + 1);
 
     /* Ignore if video RAM access is disabled */
@@ -1939,7 +1939,7 @@ BOOLEAN NTAPI VgaWriteMemory(ULONG Address, PVOID Buffer, ULONG Size)
     PUCHAR BufPtr = (PUCHAR)Buffer;
 
     DPRINT("VgaWriteMemory: Address 0x%08X, Size %lu\n", Address, Size);
-    Address = max(min(Address, VgaGetVideoLimitAddress() - 1), VgaGetVideoBaseAddress());
+    Address = min(max(Address, VgaGetVideoLimitAddress() - 1), VgaGetVideoBaseAddress());
     Size = min(Size, VgaGetVideoLimitAddress() - Address + 1);
 
     /* Ignore if video RAM access is disabled */