FreeBSD Bugzilla – Attachment 210991 Details for
Bug 243533
vt_fb.c can overwrite frame buffer bounds if stride length is not a multiple of bytes-per-pixel
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
fix vt_fb_blank().
vt_buf_fix1.txt (text/plain), 955 bytes, created by
Thomas Skibo
on 2020-01-23 16:57:47 UTC
(
hide
)
Description:
fix vt_fb_blank().
Filename:
MIME Type:
Creator:
Thomas Skibo
Created:
2020-01-23 16:57:47 UTC
Size:
955 bytes
patch
obsolete
>Index: sys/dev/vt/hw/fb/vt_fb.c >=================================================================== >--- sys/dev/vt/hw/fb/vt_fb.c (revision 356880) >+++ sys/dev/vt/hw/fb/vt_fb.c (working copy) >@@ -235,12 +235,12 @@ > break; > case 2: > for (h = 0; h < info->fb_height; h++) >- for (o = 0; o < info->fb_stride; o += 2) >+ for (o = 0; o < info->fb_stride - 1; o += 2) > vt_fb_mem_wr2(info, h*info->fb_stride + o, c); > break; > case 3: > for (h = 0; h < info->fb_height; h++) >- for (o = 0; o < info->fb_stride; o += 3) { >+ for (o = 0; o < info->fb_stride - 2; o += 3) { > vt_fb_mem_wr1(info, h*info->fb_stride + o, > (c >> 16) & 0xff); > vt_fb_mem_wr1(info, h*info->fb_stride + o + 1, >@@ -251,7 +251,7 @@ > break; > case 4: > for (h = 0; h < info->fb_height; h++) >- for (o = 0; o < info->fb_stride; o += 4) >+ for (o = 0; o < info->fb_stride - 3; o += 4) > vt_fb_mem_wr4(info, h*info->fb_stride + o, c); > break; > default:
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=210991">View the attachment on a separate page</a>.</b>
View Attachment As Raw
Actions:
View
Attachments on
bug 243533
:
210977
| 210991