Author: emaste
Date: Sat Apr 4 00:31:30 2020
New Revision: 359626
URL: https://svnweb.freebsd.org/changeset/base/359626
Log:
vt: avoid overrun when stride is not a multiple of bytes per pixel
The reporter is developing a frame buffer driver for hardware using
3 bytes per pixel, but a stride that's a multiple of 256. Previously
this resulted in writing beyond the end of each stride. On the last
row this attempted to write past the end of the frame buffer, triggering
the assertion in vt_fb_mem_wr1().
PR: 243533
MFC after: 2 weeks
Submitted by: Thomas Skibo
Modified:
head/sys/dev/vt/hw/fb/vt_fb.c
Modified: head/sys/dev/vt/hw/fb/vt_fb.c
==============================================================================
--- head/sys/dev/vt/hw/fb/vt_fb.c Fri Apr 3 23:00:26 2020
(r359625)
+++ head/sys/dev/vt/hw/fb/vt_fb.c Sat Apr 4 00:31:30 2020
(r359626)
@@ -235,12 +235,12 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
break;
case 2:
for (h = 0; h < info->fb_height; h++)
- for (o = 0; o < info->fb_stride; o += 2)
+ for (o = 0; o < info->fb_stride - 1; o += 2)
vt_fb_mem_wr2(info, h*info->fb_stride + o, c);
break;
case 3:
for (h = 0; h < info->fb_height; h++)
- for (o = 0; o < info->fb_stride; o += 3) {
+ for (o = 0; o < info->fb_stride - 2; o += 3) {
vt_fb_mem_wr1(info, h*info->fb_stride + o,
(c >> 16) & 0xff);
vt_fb_mem_wr1(info, h*info->fb_stride + o + 1,
@@ -251,7 +251,7 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
break;
case 4:
for (h = 0; h < info->fb_height; h++)
- for (o = 0; o < info->fb_stride; o += 4)
+ for (o = 0; o < info->fb_stride - 3; o += 4)
vt_fb_mem_wr4(info, h*info->fb_stride + o, c);
break;
default:
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
