diff --git a/ati-check-x-y-display-parameter-values.patch b/ati-check-x-y-display-parameter-values.patch
new file mode 100644
index 0000000000000000000000000000000000000000..219ec0d1c65d5d53fbe95bf40152b001e71edb96
--- /dev/null
+++ b/ati-check-x-y-display-parameter-values.patch
@@ -0,0 +1,53 @@
+From 2a3f92b2ba5fe015f83fa8c8fceb2dfc426d908c Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Wed, 18 Nov 2020 10:22:32 +0800
+Subject: [PATCH] ati: check x y display parameter values
+
+fix CVE-2020-24352
+
+The source and destination x,y display parameters in ati_2d_blt()
+may run off the vga limits if either of s->regs.[src|dst]_[xy] is
+zero. Check the parameter values to avoid potential crash.
+
+Reported-by: Gaoning Pan <pgn@zju.edu.cn>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Message-id: 20201021103818.1704030-1-ppandit@redhat.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+cherry-pick from commit ca1f9cbfdce4d63b10d57de80fef89a89d92a540
+Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
+---
+ hw/display/ati_2d.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
+index 23a8ae0cd8..4dc10ea795 100644
+--- a/hw/display/ati_2d.c
++++ b/hw/display/ati_2d.c
+@@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s)
+         dst_stride *= bpp;
+     }
+     uint8_t *end = s->vga.vram_ptr + s->vga.vram_size;
+-    if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) *
+-        dst_stride >= end) {
++    if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end
++        || dst_bits + dst_x
++         + (dst_y + s->regs.dst_height) * dst_stride >= end) {
+         qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
+         return;
+     }
+@@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s)
+             src_bits += s->regs.crtc_offset & 0x07ffffff;
+             src_stride *= bpp;
+         }
+-        if (src_bits >= end || src_bits + src_x +
+-            (src_y + s->regs.dst_height) * src_stride >= end) {
++        if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end
++            || src_bits + src_x
++             + (src_y + s->regs.dst_height) * src_stride >= end) {
+             qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
+             return;
+         }
+-- 
+2.27.0
+
diff --git a/qemu.spec b/qemu.spec
index 6972275d372b2ac31a38ff9f9b40d733fb0f2948..e730aba801c5d0f2e7378354f486720a4e3041b3 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,6 +1,6 @@
 Name: qemu
 Version: 4.1.0
-Release: 33
+Release: 34
 Epoch: 2
 Summary: QEMU is a generic and open source machine emulator and virtualizer
 License: GPLv2 and BSD and MIT and CC-BY
@@ -303,6 +303,7 @@ Patch0290: sm501-Clean-up-local-variables-in-sm501_2d_operation.patch
 Patch0291: sm501-Replace-hand-written-implementation-with-pixma.patch
 Patch0292: pci-check-bus-pointer-before-dereference.patch
 Patch0293: hw-ide-check-null-block-before-_cancel_dma_sync.patch
+Patch0294: ati-check-x-y-display-parameter-values.patch
 
 BuildRequires: flex
 BuildRequires: bison
@@ -649,6 +650,9 @@ getent passwd qemu >/dev/null || \
 %endif
 
 %changelog
+* Wed Nov 18 2020 Huawei Technologies Co., Ltd <alex.chen@huawei.com>
+- ati: check x y display parameter values
+
 * Wed Oct 14 2020 Prasad J Pandit <pjp@fedoraproject.org>
 - pci: check bus pointer before dereference
 - hw/ide: check null block before _cancel_dma_sync