Hi
Am 04.10.25 um 02:43 schrieb Helge Deller:
On 10/3/25 09:32, Albin Babu Varghese wrote:
Add bounds checking to prevent writes past framebuffer boundaries when
rendering text near screen edges. Return early if the Y position is
off-screen
and clip image height to screen boundary. Break from the rendering
loop if the
X position is off-screen. When clipping image width to fit the
screen, update
the character count to match the clipped width to prevent buffer size
mismatches.
Without the character count update, bit_putcs_aligned and
bit_putcs_unaligned
receive mismatched parameters where the buffer is allocated for the
clipped
width but cnt reflects the original larger count, causing
out-of-bounds writes.
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
Suggested-by: Helge Deller <[email protected]>
Tested-by: [email protected]
Signed-off-by: Albin Babu Varghese <[email protected]>
---
Changes in v2:
- Partially render when height exceeding screen boundaries instead of
skipping
- Update character count when width is clipped to prevent buffer
mismatch
Link to v1:
https://lore.kernel.org/all/[email protected]/
---
drivers/video/fbdev/core/bitblit.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
applied.
This patch mangles fbcon output on fbdev HW drivers. It's reproducible
on matroxfb and sisfb. Reverting the change restores these driver's
functionality.
Fbcon from within DRM's fbdev emulation works.
Best regards
Thomas
Thanks!
Helge
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Stefan Gaiser, Jochen Jaser, Abhinav Puri, (HRB 36809, AG Nürnberg)
