talexander
/
freebsd_amp_hwpstate
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vt: avoid overrun when stride is not a multiple of bytes per pixel 

The reporter is developing a frame buffer driver for hardware using
3 bytes per pixel, but a stride that's a multiple of 256.  Previously
this resulted in writing beyond the end of each stride.  On the last
row this attempted to write past the end of the frame buffer, triggering
the assertion in vt_fb_mem_wr1().

PR:		243533
MFC after:	2 weeks
Submitted by:	Thomas Skibo
This commit is contained in:
Ed Maste 2020-04-04 00:31:30 +00:00
parent 92b14858b4
commit 2efe3be95e
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/dev/vt/hw/fb/vt_fb.c
View File

@ -235,12 +235,12 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
break;
case 2:
for (h = 0; h < info->fb_height; h++)
for (o = 0; o < info->fb_stride; o += 2)
for (o = 0; o < info->fb_stride - 1; o += 2)
vt_fb_mem_wr2(info, h*info->fb_stride + o, c);
break;
case 3:
for (h = 0; h < info->fb_height; h++)
for (o = 0; o < info->fb_stride; o += 3) {
for (o = 0; o < info->fb_stride - 2; o += 3) {
vt_fb_mem_wr1(info, h*info->fb_stride + o,
(c >> 16) & 0xff);
vt_fb_mem_wr1(info, h*info->fb_stride + o + 1,
@ -251,7 +251,7 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
break;
case 4:
for (h = 0; h < info->fb_height; h++)
for (o = 0; o < info->fb_stride; o += 4)
for (o = 0; o < info->fb_stride - 3; o += 4)
vt_fb_mem_wr4(info, h*info->fb_stride + o, c);
break;
default: