Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-25 06:00:43 +00:00
Code Issues Projects Releases Packages Wiki Activity

video: buffer overrun in TrueType console

Browse source 
When scrolling the TrueType console a buffer overrun occurs.

Fixes: a29b012037 ("video: Add a console driver that uses TrueType fonts")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Heinrich Schuchardt 2021-02-28 21:42:51 +01:00
parent 5371593aed
commit ab08c685a9
1 changed files with 12 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
drivers/video/console_truetype.c
View file

@ -128,38 +128,36 @@ static int console_truetype_set_row(struct udevice *dev, uint row, int clr)
struct video_priv *vid_priv = dev_get_uclass_priv(dev->parent);
struct console_tt_priv *priv = dev_get_priv(dev);
void *end, *line;
int pixels = priv->font_size * vid_priv->line_length;
int i, ret;
int ret;
line = vid_priv->fb + row * priv->font_size * vid_priv->line_length;
end = line + priv->font_size * vid_priv->line_length;
switch (vid_priv->bpix) {
#ifdef CONFIG_VIDEO_BPP8
case VIDEO_BPP8: {
uint8_t *dst = line;
u8 *dst;
for (i = 0; i < pixels; i++)
*dst++ = clr;
end = dst;
for (dst = line; dst < (u8 *)end; ++dst)
*dst = clr;
break;
}
#endif
#ifdef CONFIG_VIDEO_BPP16
case VIDEO_BPP16: {
uint16_t *dst = line;
u16 *dst = line;
for (i = 0; i < pixels; i++)
*dst++ = clr;
end = dst;
for (dst = line; dst < (u16 *)end; ++dst)
*dst = clr;
break;
}
#endif
#ifdef CONFIG_VIDEO_BPP32
case VIDEO_BPP32: {
uint32_t *dst = line;
u32 *dst = line;
for (i = 0; i < pixels; i++)
*dst++ = clr;
end = dst;
for (dst = line; dst < (u32 *)end; ++dst)
*dst = clr;
break;
}
#endif