The "stride" property is optional: without it, the video uclass works
out the line length from the width and the pixel format. But the check
ret = ofnode_read_u32(node, "stride", &stride);
if (!ret || stride)
reads the local stride even when ofnode_read_u32() failed. The property
is then absent and stride was never set, so any non-zero value left on
the stack is used as the line length. Clearing the framebuffer and all
drawing then use that line length, which can reach memory outside the
framebuffer.
Only use the stride when it was read successfully and is not zero, so
that a missing or zero stride falls back to the calculated line length.
Fixes: ac56c61332e6 ("video: simplefb: Add stride handling")
Signed-off-by: nacht20-de <[email protected]>
---
Resend: the original posting (2026-09-27) was held in list moderation
and never reached the archive. No changes.
drivers/video/simplefb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/simplefb.c b/drivers/video/simplefb.c
index 631ae00b1e1..6d7fc23105b 100644
--- a/drivers/video/simplefb.c
+++ b/drivers/video/simplefb.c
@@ -69,7 +69,7 @@ static int simple_video_probe(struct udevice *dev)
/* Optional - in most cases, auto-calculation works */
ret = ofnode_read_u32(node, "stride", &stride);
- if (!ret || stride)
+ if (!ret && stride)
uc_priv->line_length = stride;
format = ofnode_read_string(node, "format");
--
2.55.0
