d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vt: avoid overrun when stride is not a multiple of bytes per pixel

Browse Source 
The reporter is developing a frame buffer driver for hardware using
3 bytes per pixel, but a stride that's a multiple of 256.  Previously
this resulted in writing beyond the end of each stride.  On the last
row this attempted to write past the end of the frame buffer, triggering
the assertion in vt_fb_mem_wr1().

PR:		243533
MFC after:	2 weeks
Submitted by:	Thomas Skibo
This commit is contained in:
emaste 2020-04-04 00:31:30 +00:00
parent b460ff02eb
commit cf7b40afe1
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/dev/vt/hw/fb/vt_fb.c
View File

@ -235,12 +235,12 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
break;
case 2:
for (h = 0; h < info->fb_height; h++)
for (o = 0; o < info->fb_stride; o += 2)
for (o = 0; o < info->fb_stride - 1; o += 2)
vt_fb_mem_wr2(info, h*info->fb_stride + o, c);
break;
case 3:
for (h = 0; h < info->fb_height; h++)
for (o = 0; o < info->fb_stride; o += 3) {
for (o = 0; o < info->fb_stride - 2; o += 3) {
vt_fb_mem_wr1(info, h*info->fb_stride + o,
(c >> 16) & 0xff);
vt_fb_mem_wr1(info, h*info->fb_stride + o + 1,
@ -251,7 +251,7 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
break;
case 4:
for (h = 0; h < info->fb_height; h++)
for (o = 0; o < info->fb_stride; o += 4)
for (o = 0; o < info->fb_stride - 3; o += 4)
vt_fb_mem_wr4(info, h*info->fb_stride + o, c);
break;
default: