FreeBSD Bugzilla – Attachment 210977 Details for
Bug 243533
vt_fb.c can overwrite frame buffer bounds if stride length is not a multiple of bytes-per-pixel
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
fix vt_fb_blank().
vt_buf_fix2.txt (text/plain), 1.14 KB, created by
Thomas Skibo
on 2020-01-23 00:44:15 UTC
(
hide
)
Description:
fix vt_fb_blank().
Filename:
MIME Type:
Creator:
Thomas Skibo
Created:
2020-01-23 00:44:15 UTC
Size:
1.14 KB
patch
obsolete
>Index: sys/dev/vt/hw/fb/vt_fb.c >=================================================================== >--- sys/dev/vt/hw/fb/vt_fb.c (revision 356880) >+++ sys/dev/vt/hw/fb/vt_fb.c (working copy) >@@ -230,17 +230,17 @@ > switch (FBTYPE_GET_BYTESPP(info)) { > case 1: > for (h = 0; h < info->fb_height; h++) >- for (o = 0; o < info->fb_stride; o++) >+ for (o = 0; o < info->fb_width; o++) > vt_fb_mem_wr1(info, h*info->fb_stride + o, c); > break; > case 2: > for (h = 0; h < info->fb_height; h++) >- for (o = 0; o < info->fb_stride; o += 2) >+ for (o = 0; o < info->fb_width; o += 2) > vt_fb_mem_wr2(info, h*info->fb_stride + o, c); > break; > case 3: > for (h = 0; h < info->fb_height; h++) >- for (o = 0; o < info->fb_stride; o += 3) { >+ for (o = 0; o < info->fb_width; o += 3) { > vt_fb_mem_wr1(info, h*info->fb_stride + o, > (c >> 16) & 0xff); > vt_fb_mem_wr1(info, h*info->fb_stride + o + 1, >@@ -251,7 +251,7 @@ > break; > case 4: > for (h = 0; h < info->fb_height; h++) >- for (o = 0; o < info->fb_stride; o += 4) >+ for (o = 0; o < info->fb_width; o += 4) > vt_fb_mem_wr4(info, h*info->fb_stride + o, c); > break; > default:
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 243533
:
210977
|
210991