This fixes an out-of-bounds write in the RLE8 BMP decoder and adds a regression test.
video_display_rle8_bitmap() lets the framebuffer cursor drift below the start of the framebuffer via repeated End-Of-Line escapes, so a crafted image displayed from the splash-screen or PXE-menu path (loaded from removable media or over TFTP) writes before the framebuffer. Patch 1 bounds each run and rejects such an image with -EINVAL; patch 2 adds a DM test for it. Based on v2026.07 (fdfe2ec48d5c). Signed-off-by: shj <[email protected]> --- shj (2): video: bmp: bound RLE8 decode writes to the framebuffer test: video: add regression test for RLE8 bmp overflow drivers/video/video_bmp.c | 26 +++++++++++++++++------- test/dm/video.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 7 deletions(-) --- base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1 change-id: 20260722-video-oob-fix-69c4a7298519 Best regards, -- shj <[email protected]>
