Date: Thu, 23 Jan 2020 00:44:15 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 243533] vt_fb.c can overwrite frame buffer bounds if stride length is not a multiple of bytes-per-pixel Message-ID: <bug-243533-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=243533 Bug ID: 243533 Summary: vt_fb.c can overwrite frame buffer bounds if stride length is not a multiple of bytes-per-pixel Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: thoma555-bsd@yahoo.com Created attachment 210977 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=210977&action=edit fix vt_fb_blank(). I'm developing a frame buffer driver for hardware using 3 bytes per pixel but the hardware requires the stride to be a multiple of 256 bytes. Because the stride is not a multiple of 3 bytes, the way vt_fb_blank() is coded, it writes past the end of each stride and, on the last line, writes past the end of the frame buffer. This is caught by a KASSERT in vt_fb_mem_wr1(). I think the loops in vt_fb_blank() could just stop at the end of the line (fb_width) instead of clearing memory all the way to the end of a stride. The other way would be to limit the loops with fb_stride - 1, fb_stride - 2, fb_stride - 3 for the cases of 2,3,4 bytes per pixel. -- You are receiving this mail because: You are the assignee for the bug.help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-243533-227>