svn commit: r360308 - stable/12/sys/dev/vt/hw/fb

[Ed Maste]

Author: emaste
Date: Sat Apr 25 15:17:43 2020
New Revision: 360308
URL: https://svnweb.freebsd.org/changeset/base/360308

Log:
  MFC r359626: vt: avoid overrun when stride is not a multiple of bytes per pixel
  
  PR:		243533
  Submitted by:	Thomas Skibo

Modified:
  stable/12/sys/dev/vt/hw/fb/vt_fb.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/dev/vt/hw/fb/vt_fb.c
==============================================================================
--- stable/12/sys/dev/vt/hw/fb/vt_fb.c	Sat Apr 25 15:16:35 2020	(r360307)
+++ stable/12/sys/dev/vt/hw/fb/vt_fb.c	Sat Apr 25 15:17:43 2020	(r360308)
@@ -234,12 +234,12 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
 		break;
 	case 2:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 2)
+			for (o = 0; o < info->fb_stride - 1; o += 2)
 				vt_fb_mem_wr2(info, h*info->fb_stride + o, c);
 		break;
 	case 3:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 3) {
+			for (o = 0; o < info->fb_stride - 2; o += 3) {
 				vt_fb_mem_wr1(info, h*info->fb_stride + o,
 				    (c >> 16) & 0xff);
 				vt_fb_mem_wr1(info, h*info->fb_stride + o + 1,
@@ -250,7 +250,7 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
 		break;
 	case 4:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 4)
+			for (o = 0; o < info->fb_stride - 3; o += 4)
 				vt_fb_mem_wr4(info, h*info->fb_stride + o, c);
 		break;
 	default: