[Bug 243533] vt_fb.c can overwrite frame buffer bounds if stride length is not a multiple of bytes-per-pixel

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=243533

            Bug ID: 243533
           Summary: vt_fb.c can overwrite frame buffer bounds if stride
                    length is not a multiple of bytes-per-pixel
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: thoma555-bsd at yahoo.com

Created attachment 210977
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=210977&action=edit
fix vt_fb_blank().

I'm developing a frame buffer driver for hardware using 3 bytes per pixel but
the hardware requires the stride to be a multiple of 256 bytes.  Because the
stride is not a multiple of 3 bytes, the way vt_fb_blank() is coded, it writes
past the end of each stride and, on the last line, writes past the end of the
frame buffer.  This is caught by a KASSERT in vt_fb_mem_wr1().

I think the loops in vt_fb_blank() could just stop at the end of the line
(fb_width) instead of clearing memory all the way to the end of a stride.  The
other way would be to limit the loops with fb_stride - 1, fb_stride - 2,
fb_stride - 3 for the cases of 2,3,4 bytes per pixel.

-- 
You are receiving this mail because:
You are the assignee for the bug.