Fix buffer overruns in modes with color depth more than 8.
Support for 16-bit and 32-bit Truecolor modes was supposed to be complete in r70991 of main.c and in nearby revisions for other files, but it was broken by the overruns in most cases (all cases were the mouse is enabled, and most cases where bitmaps are used). r70991 also uninintentionally added support for depths 9-15, 17-23 and 25-31. Depth 24 was more obviously broken and its support is ifdefed out. In the other ranges, only depth 15 is common. It was broken by buffer overruns in all cases. bitmap.c: - the static buffer was used even when it was too small (but it was large enough to often work accidentally in depth 16) - the size of the dynamically allocated buffer was too small - the sizing info bitmap->PixelBytes was not inititialzed in the bitmap constructor. It often ended up as 0 for MEMBUFs, so using it in more places gave more null pointer accesses. (It is per-bitmap, but since conversion between bitmaps of different depths is not supported (except from 4 bits by padding to 8), it would work better if it were global.) main.c: - depths were rounded down instead of up to a multiple of 8, so PixelBytes was 1 too small for depths above 8 except 16, 24 and 32. - PixelBytes was not initialized for 4-bit planar modes. It isn't really used for frame buffer accesses in these modes, but needs to be 1 in MEMBUF images. mouse.c: - the mouse cursor buffers were too small. vgl.h: - PixelBytes was not initialized in the static bitmap constructor. It should be initialized to the value for the current mode, but that is impossible in a static constructor. Initialize it to -1 so as to fail if it is used without further initialization. All modes that are supposed to be supported now don't crash in nontrivial tests, and almost work. Missing uses of PixelBytes now give in-bounds wrong pointers instead of overruns. Misconversions of bitmaps give multiple miscolored mouse cursors instead of 1 white one, and similarly for bitmaps copied through a MEMBUF.
This commit is contained in:
parent
14243f8de7
commit
fbc6daa1dc
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=345478
@ -338,8 +338,8 @@ __VGLBitmapCopy(VGLBitmap *src, int srcx, int srcy,
|
|||||||
byte buffer[2048]; /* XXX */
|
byte buffer[2048]; /* XXX */
|
||||||
byte *p;
|
byte *p;
|
||||||
|
|
||||||
if (width > sizeof(buffer)) {
|
if (width * src->PixelBytes > sizeof(buffer)) {
|
||||||
p = malloc(width);
|
p = malloc(width * src->PixelBytes);
|
||||||
if (p == NULL)
|
if (p == NULL)
|
||||||
return 1;
|
return 1;
|
||||||
} else {
|
} else {
|
||||||
@ -349,7 +349,7 @@ __VGLBitmapCopy(VGLBitmap *src, int srcx, int srcy,
|
|||||||
ReadVerticalLine(src, srcx, srcline, width, p);
|
ReadVerticalLine(src, srcx, srcline, width, p);
|
||||||
WriteVerticalLine(dst, dstx, dstline, width, p);
|
WriteVerticalLine(dst, dstx, dstline, width, p);
|
||||||
}
|
}
|
||||||
if (width > sizeof(buffer))
|
if (width * src->PixelBytes > sizeof(buffer))
|
||||||
free(p);
|
free(p);
|
||||||
}
|
}
|
||||||
return 0;
|
return 0;
|
||||||
@ -387,6 +387,7 @@ VGLBitmap
|
|||||||
object->Xorigin = 0;
|
object->Xorigin = 0;
|
||||||
object->Yorigin = 0;
|
object->Yorigin = 0;
|
||||||
object->Bitmap = bits;
|
object->Bitmap = bits;
|
||||||
|
object->PixelBytes = VGLDisplay->PixelBytes;
|
||||||
return object;
|
return object;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -401,7 +402,7 @@ VGLBitmapDestroy(VGLBitmap *object)
|
|||||||
int
|
int
|
||||||
VGLBitmapAllocateBits(VGLBitmap *object)
|
VGLBitmapAllocateBits(VGLBitmap *object)
|
||||||
{
|
{
|
||||||
object->Bitmap = (byte *)malloc(object->VXsize*object->VYsize);
|
object->Bitmap = malloc(object->VXsize*object->VYsize*object->PixelBytes);
|
||||||
if (object->Bitmap == NULL)
|
if (object->Bitmap == NULL)
|
||||||
return -1;
|
return -1;
|
||||||
return 0;
|
return 0;
|
||||||
|
@ -132,7 +132,7 @@ int
|
|||||||
VGLInit(int mode)
|
VGLInit(int mode)
|
||||||
{
|
{
|
||||||
struct vt_mode smode;
|
struct vt_mode smode;
|
||||||
int adptype;
|
int adptype, depth;
|
||||||
|
|
||||||
if (VGLInitDone)
|
if (VGLInitDone)
|
||||||
return -1;
|
return -1;
|
||||||
@ -188,6 +188,7 @@ VGLInit(int mode)
|
|||||||
return -4;
|
return -4;
|
||||||
}
|
}
|
||||||
VGLDisplay->Type = VIDBUF4;
|
VGLDisplay->Type = VIDBUF4;
|
||||||
|
VGLDisplay->PixelBytes = 1;
|
||||||
break;
|
break;
|
||||||
case V_INFO_MM_PACKED:
|
case V_INFO_MM_PACKED:
|
||||||
/* we can do only 256 color packed modes */
|
/* we can do only 256 color packed modes */
|
||||||
@ -294,8 +295,11 @@ VGLInit(int mode)
|
|||||||
|
|
||||||
VGLDisplay->Xsize = VGLModeInfo.vi_width;
|
VGLDisplay->Xsize = VGLModeInfo.vi_width;
|
||||||
VGLDisplay->Ysize = VGLModeInfo.vi_height;
|
VGLDisplay->Ysize = VGLModeInfo.vi_height;
|
||||||
|
depth = VGLModeInfo.vi_depth;
|
||||||
|
if (depth == 15)
|
||||||
|
depth = 16;
|
||||||
VGLDisplay->VXsize = VGLAdpInfo.va_line_width
|
VGLDisplay->VXsize = VGLAdpInfo.va_line_width
|
||||||
*8/(VGLModeInfo.vi_depth/VGLModeInfo.vi_planes);
|
*8/(depth/VGLModeInfo.vi_planes);
|
||||||
VGLDisplay->VYsize = VGLBufSize/VGLModeInfo.vi_planes/VGLAdpInfo.va_line_width;
|
VGLDisplay->VYsize = VGLBufSize/VGLModeInfo.vi_planes/VGLAdpInfo.va_line_width;
|
||||||
VGLDisplay->Xorigin = 0;
|
VGLDisplay->Xorigin = 0;
|
||||||
VGLDisplay->Yorigin = 0;
|
VGLDisplay->Yorigin = 0;
|
||||||
@ -530,6 +534,8 @@ VGLSetSegment(unsigned int offset)
|
|||||||
int
|
int
|
||||||
VGLSetVScreenSize(VGLBitmap *object, int VXsize, int VYsize)
|
VGLSetVScreenSize(VGLBitmap *object, int VXsize, int VYsize)
|
||||||
{
|
{
|
||||||
|
int depth;
|
||||||
|
|
||||||
if (VXsize < object->Xsize || VYsize < object->Ysize)
|
if (VXsize < object->Xsize || VYsize < object->Ysize)
|
||||||
return -1;
|
return -1;
|
||||||
if (object->Type == MEMBUF)
|
if (object->Type == MEMBUF)
|
||||||
@ -537,8 +543,11 @@ VGLSetVScreenSize(VGLBitmap *object, int VXsize, int VYsize)
|
|||||||
if (ioctl(0, FBIO_SETLINEWIDTH, &VXsize))
|
if (ioctl(0, FBIO_SETLINEWIDTH, &VXsize))
|
||||||
return -1;
|
return -1;
|
||||||
ioctl(0, CONS_ADPINFO, &VGLAdpInfo); /* FBIO_ADPINFO */
|
ioctl(0, CONS_ADPINFO, &VGLAdpInfo); /* FBIO_ADPINFO */
|
||||||
|
depth = VGLModeInfo.vi_depth;
|
||||||
|
if (depth == 15)
|
||||||
|
depth = 16;
|
||||||
object->VXsize = VGLAdpInfo.va_line_width
|
object->VXsize = VGLAdpInfo.va_line_width
|
||||||
*8/(VGLModeInfo.vi_depth/VGLModeInfo.vi_planes);
|
*8/(depth/VGLModeInfo.vi_planes);
|
||||||
object->VYsize = VGLBufSize/VGLModeInfo.vi_planes/VGLAdpInfo.va_line_width;
|
object->VYsize = VGLBufSize/VGLModeInfo.vi_planes/VGLAdpInfo.va_line_width;
|
||||||
if (VYsize < object->VYsize)
|
if (VYsize < object->VYsize)
|
||||||
object->VYsize = VYsize;
|
object->VYsize = VYsize;
|
||||||
|
@ -82,7 +82,7 @@ static VGLBitmap VGLMouseStdAndMask =
|
|||||||
static VGLBitmap VGLMouseStdOrMask =
|
static VGLBitmap VGLMouseStdOrMask =
|
||||||
VGLBITMAP_INITIALIZER(MEMBUF, MOUSE_IMG_SIZE, MOUSE_IMG_SIZE, StdOrMask);
|
VGLBITMAP_INITIALIZER(MEMBUF, MOUSE_IMG_SIZE, MOUSE_IMG_SIZE, StdOrMask);
|
||||||
static VGLBitmap *VGLMouseAndMask, *VGLMouseOrMask;
|
static VGLBitmap *VGLMouseAndMask, *VGLMouseOrMask;
|
||||||
static byte map[MOUSE_IMG_SIZE*MOUSE_IMG_SIZE];
|
static byte map[MOUSE_IMG_SIZE*MOUSE_IMG_SIZE*4];
|
||||||
static VGLBitmap VGLMouseSave =
|
static VGLBitmap VGLMouseSave =
|
||||||
VGLBITMAP_INITIALIZER(MEMBUF, MOUSE_IMG_SIZE, MOUSE_IMG_SIZE, map);
|
VGLBITMAP_INITIALIZER(MEMBUF, MOUSE_IMG_SIZE, MOUSE_IMG_SIZE, map);
|
||||||
static int VGLMouseVisible = 0;
|
static int VGLMouseVisible = 0;
|
||||||
@ -95,7 +95,7 @@ static int VGLMouseButtons = 0;
|
|||||||
void
|
void
|
||||||
VGLMousePointerShow()
|
VGLMousePointerShow()
|
||||||
{
|
{
|
||||||
byte buf[MOUSE_IMG_SIZE*MOUSE_IMG_SIZE];
|
byte buf[MOUSE_IMG_SIZE*MOUSE_IMG_SIZE*4];
|
||||||
VGLBitmap buffer =
|
VGLBitmap buffer =
|
||||||
VGLBITMAP_INITIALIZER(MEMBUF, MOUSE_IMG_SIZE, MOUSE_IMG_SIZE, buf);
|
VGLBITMAP_INITIALIZER(MEMBUF, MOUSE_IMG_SIZE, MOUSE_IMG_SIZE, buf);
|
||||||
byte crtcidx, crtcval, gdcidx, gdcval;
|
byte crtcidx, crtcval, gdcidx, gdcval;
|
||||||
|
@ -49,7 +49,7 @@ typedef struct {
|
|||||||
} VGLBitmap;
|
} VGLBitmap;
|
||||||
|
|
||||||
#define VGLBITMAP_INITIALIZER(t, x, y, bits) \
|
#define VGLBITMAP_INITIALIZER(t, x, y, bits) \
|
||||||
{ (t), (x), (y), (x), (y), 0, 0, (bits) }
|
{ (t), (x), (y), (x), (y), 0, 0, (bits), -1 }
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Defined Type's
|
* Defined Type's
|
||||||
|
Loading…
Reference in New Issue
Block a user