svn commit: r360309 - stable/11/sys/dev/vt/hw/fb

[Ed Maste]

Author: emaste
Date: Sat Apr 25 15:27:45 2020
New Revision: 360309
URL: https://svnweb.freebsd.org/changeset/base/360309

Log:
  MFC r359626: vt: avoid overrun when stride is not a multiple of bytes per pixel
  
  The reporter is developing a frame buffer driver for hardware using
  3 bytes per pixel, but a stride that's a multiple of 256.  Previously
  this resulted in writing beyond the end of each stride.  On the last
  row this attempted to write past the end of the frame buffer, triggering
  the assertion in vt_fb_mem_wr1().
  
  PR:		243533
  Submitted by:	Thomas Skibo

Modified:
  stable/11/sys/dev/vt/hw/fb/vt_fb.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/dev/vt/hw/fb/vt_fb.c
==============================================================================
--- stable/11/sys/dev/vt/hw/fb/vt_fb.c	Sat Apr 25 15:17:43 2020	(r360308)
+++ stable/11/sys/dev/vt/hw/fb/vt_fb.c	Sat Apr 25 15:27:45 2020	(r360309)
@@ -228,12 +228,12 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
 		break;
 	case 2:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 2)
+			for (o = 0; o < info->fb_stride - 1; o += 2)
 				vt_fb_mem_wr2(info, h*info->fb_stride + o, c);
 		break;
 	case 3:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 3) {
+			for (o = 0; o < info->fb_stride - 2; o += 3) {
 				vt_fb_mem_wr1(info, h*info->fb_stride + o,
 				    (c >> 16) & 0xff);
 				vt_fb_mem_wr1(info, h*info->fb_stride + o + 1,
@@ -244,7 +244,7 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
 		break;
 	case 4:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 4)
+			for (o = 0; o < info->fb_stride - 3; o += 4)
 				vt_fb_mem_wr4(info, h*info->fb_stride + o, c);
 		break;
 	default: