https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=243533
Bug ID: 243533
Summary: vt_fb.c can overwrite frame buffer bounds if stride
length is not a multiple of bytes-per-pixel
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: kern
Assignee: b...@freebsd.org
Reporter: thoma555-...@yahoo.com
Created attachment 210977
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=210977&action=edit
fix vt_fb_blank().
I'm developing a frame buffer driver for hardware using 3 bytes per pixel but
the hardware requires the stride to be a multiple of 256 bytes. Because the
stride is not a multiple of 3 bytes, the way vt_fb_blank() is coded, it writes
past the end of each stride and, on the last line, writes past the end of the
frame buffer. This is caught by a KASSERT in vt_fb_mem_wr1().
I think the loops in vt_fb_blank() could just stop at the end of the line
(fb_width) instead of clearing memory all the way to the end of a stride. The
other way would be to limit the loops with fb_stride - 1, fb_stride - 2,
fb_stride - 3 for the cases of 2,3,4 bytes per pixel.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
