From 2efe3be95ede0aa2e7eb4afecc40977af00d4b52 Mon Sep 17 00:00:00 2001 From: Ed Maste Date: Sat, 4 Apr 2020 00:31:30 +0000 Subject: [PATCH] vt: avoid overrun when stride is not a multiple of bytes per pixel The reporter is developing a frame buffer driver for hardware using 3 bytes per pixel, but a stride that's a multiple of 256. Previously this resulted in writing beyond the end of each stride. On the last row this attempted to write past the end of the frame buffer, triggering the assertion in vt_fb_mem_wr1(). PR: 243533 MFC after: 2 weeks Submitted by: Thomas Skibo --- sys/dev/vt/hw/fb/vt_fb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/dev/vt/hw/fb/vt_fb.c b/sys/dev/vt/hw/fb/vt_fb.c index 7691a387991..58111ada366 100644 --- a/sys/dev/vt/hw/fb/vt_fb.c +++ b/sys/dev/vt/hw/fb/vt_fb.c @@ -235,12 +235,12 @@ vt_fb_blank(struct vt_device *vd, term_color_t color) break; case 2: for (h = 0; h < info->fb_height; h++) - for (o = 0; o < info->fb_stride; o += 2) + for (o = 0; o < info->fb_stride - 1; o += 2) vt_fb_mem_wr2(info, h*info->fb_stride + o, c); break; case 3: for (h = 0; h < info->fb_height; h++) - for (o = 0; o < info->fb_stride; o += 3) { + for (o = 0; o < info->fb_stride - 2; o += 3) { vt_fb_mem_wr1(info, h*info->fb_stride + o, (c >> 16) & 0xff); vt_fb_mem_wr1(info, h*info->fb_stride + o + 1, @@ -251,7 +251,7 @@ vt_fb_blank(struct vt_device *vd, term_color_t color) break; case 4: for (h = 0; h < info->fb_height; h++) - for (o = 0; o < info->fb_stride; o += 4) + for (o = 0; o < info->fb_stride - 3; o += 4) vt_fb_mem_wr4(info, h*info->fb_stride + o, c); break; default: