This fixes an out-of-bounds write in the RLE8 BMP decoder and adds a regression test.
video_display_rle8_bitmap() lets the framebuffer cursor drift below the start of the framebuffer via repeated End-Of-Line escapes, so a crafted image displayed from the splash-screen or PXE-menu path (loaded from removable media or over TFTP) writes before the framebuffer. Patch 1 bounds each run and rejects such an image with -EINVAL; patch 2 adds a DM test for it. Based on v2026.07 (fdfe2ec48d5c). Signed-off-by: Shahriyar Jalayeri <[email protected]> --- Changes in v3: - Propagate the return code from video_display_rle8_bitmap() instead of flattening it to -EINVAL (Simon Glass) Changes in v2: - Use my real name in the From and Signed-off-by --- Shahriyar Jalayeri (2): video: bmp: bound RLE8 decode writes to the framebuffer test: video: add regression test for RLE8 bmp overflow drivers/video/video_bmp.c | 28 +++++++++++++++++++------- test/dm/video.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+), 7 deletions(-) --- base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1 change-id: 20260722-video-oob-fix-69c4a7298519 Best regards, -- Shahriyar Jalayeri <[email protected]>
