Author: emaste
Date: Sat Apr 25 15:17:43 2020
New Revision: 360308
URL: https://svnweb.freebsd.org/changeset/base/360308
Log:
MFC r359626: vt: avoid overrun when stride is not a multiple of bytes per
pixel
PR: 243533
Submitted by: Thomas Skibo
Modified:
stable/12/sys/dev/vt/hw/fb/vt_fb.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/dev/vt/hw/fb/vt_fb.c
==============================================================================
--- stable/12/sys/dev/vt/hw/fb/vt_fb.c Sat Apr 25 15:16:35 2020
(r360307)
+++ stable/12/sys/dev/vt/hw/fb/vt_fb.c Sat Apr 25 15:17:43 2020
(r360308)
@@ -234,12 +234,12 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
break;
case 2:
for (h = 0; h < info->fb_height; h++)
- for (o = 0; o < info->fb_stride; o += 2)
+ for (o = 0; o < info->fb_stride - 1; o += 2)
vt_fb_mem_wr2(info, h*info->fb_stride + o, c);
break;
case 3:
for (h = 0; h < info->fb_height; h++)
- for (o = 0; o < info->fb_stride; o += 3) {
+ for (o = 0; o < info->fb_stride - 2; o += 3) {
vt_fb_mem_wr1(info, h*info->fb_stride + o,
(c >> 16) & 0xff);
vt_fb_mem_wr1(info, h*info->fb_stride + o + 1,
@@ -250,7 +250,7 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
break;
case 4:
for (h = 0; h < info->fb_height; h++)
- for (o = 0; o < info->fb_stride; o += 4)
+ for (o = 0; o < info->fb_stride - 3; o += 4)
vt_fb_mem_wr4(info, h*info->fb_stride + o, c);
break;
default:
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
