From patchwork Sun Feb 28 20:54:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heinrich Schuchardt X-Patchwork-Id: 1445318 X-Patchwork-Delegate: xypron.glpk@gmx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=gmx.net header.i=@gmx.net header.a=rsa-sha256 header.s=badeba3b8450 header.b=VGY0SCgu; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4DpbHQ4zCjz9sWH for ; Mon, 1 Mar 2021 07:54:34 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 7E3D2804E7; Sun, 28 Feb 2021 21:54:25 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=gmx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; secure) header.d=gmx.net header.i=@gmx.net header.b="VGY0SCgu"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 5496D803AB; Sun, 28 Feb 2021 21:54:23 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,FREEMAIL_FROM,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id A6974803AB for ; Sun, 28 Feb 2021 21:54:20 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=xypron.glpk@gmx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1614545659; bh=j22kDEnCcOAQwll96U2vEeM6xuBpren1bhriB4HDEwg=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date; b=VGY0SCguQRs+adXvoFbbQO6U4a4L4LV5HRSKwrZPFlTYYD9BasW0NiUZ9tD0h/Eym KOyQ5iRWktzqDmbbYBIS0ptkFEPaW1qMOlb6zQ6RANo1bNta3Y8cnyCPTKOHhuB+QQ u9sXEK8e+xwb3dAf5deFjDvSRiYkNUQ6WFO4JZIA= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from lorawanserver.fritz.box ([62.143.246.89]) by mail.gmx.net (mrgmx004 [212.227.17.184]) with ESMTPSA (Nemesis) id 1Mf07E-1ljmDJ1weA-00gYcB; Sun, 28 Feb 2021 21:54:19 +0100 From: Heinrich Schuchardt To: Anatolij Gustschin Cc: Simon Glass , u-boot@lists.denx.de, Heinrich Schuchardt Subject: [PATCH 1/1] video: buffer overrun in TrueType console Date: Sun, 28 Feb 2021 21:54:13 +0100 Message-Id: <20210228205413.1088-1-xypron.glpk@gmx.de> X-Mailer: git-send-email 2.30.1 MIME-Version: 1.0 X-Provags-ID: V03:K1:4ipwXxDupinBYPfkVvpWxTQXAdMKordKUato2aSIbZ5CNkUoKYG /EZNa6R88vmVLt3Dab15kRu9A9dS7Du+XtF6MZgjfU6O7n4QaLrv107UYgEO7PjSdcU3YDi K2AyVvK7CVNj6X6+1XqlxA8vAdn7qs7jHedCDVCYS5MyE+d8Ka3lvWEOOcDgWqBgN5ix5rp /4Y1huV17TXE2bHZcI95A== X-UI-Out-Filterresults: notjunk:1;V03:K0:87pvlpuu1fI=:P2CPLl94mEKaYRlrZtZeoE YsO/EgsJeJM8n9tLn+0KAIFzYCfwXJVj05nIzI4hFEjSHzCI+pU9cKE2Cul8fba9bsNq1REwn ING0WAnIPp5D0qJ53czzv+kb/Ywc0KdKbQ8xxGZRgT22lSv/4CuAer+LU0aEaGnr+zQ5H47hf v2+46ts4raEZZzdRtvha/0W8ZJV3msquEdUhNRh6Xm6Qiz9vYq99Jv3KpNRSnfhc71VAm+GFi zSh3XrXKeNaOWUs6lJE7fP/a4TtRUC7SzToynVMeXynJ558pH7uVjeR4NSWwa/5Kj4mHKWEks bSYWQTk/0i1lw4WN8hEN0mJRFn22CghEg6yHUXJx/y3QA7fwPUHtaVuBUvJt3NyBZFxVzGrHD XvKA4wwxF5mlmCRHHl71TV+ZauHm9/LG+FaZ6tZKznT+HvBnP3+oyPAIPMkV3lW4vEEpvmjFg nDoB92Of1SyfVm2Z5hA54ZtBgEqk7Mizmhek0cI+9liLvtgwR0xJ2h3PyfjHqZsttE1TBZEkH 00NTvUrveKZLyNZrn1o+1ox3Q5+RO9FkXPDcC9Ud7KtijTtUaqQO/OAl1mAbZnU6qfKH+AE+y zI1TkAvwwZQV+t9Ra4OZpx+uPylwAfFlFW86gReQZMkdMmWIUvVCwg3t7Ora5VcPq1/XvJ6Ce slEdl+c5qfdNKeFc2Ar9c/As7ct/aIpmmeqAUEpwYt//tBdmBQdpEz8dTKg7rJkTUzeUlJXDX 4n+KZ+SxyxquXD+2Gew33bS4RN4OHxtno9KFchqOO+CFy0lliyBN9J3Zu0YNSpdKonAQw014b AW462vTyqZLJEsuFUmaBMu4icPSD4LhXOu0UJEBW5EjHuiWCqH/1Cq3LRoAE7GuPBmD2yoU7p WmO1jiqLAbpyF4yL6T9g== X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.4 at phobos.denx.de X-Virus-Status: Clean When scrolling the TrueType console a buffer overrun occurs. Fixes: a29b012037cc ("video: Add a console driver that uses TrueType fonts") Signed-off-by: Heinrich Schuchardt Reviewed-by: Simon Glass --- drivers/video/console_truetype.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) -- 2.30.1 diff --git a/drivers/video/console_truetype.c b/drivers/video/console_truetype.c index b9d467ac90..6d40be6482 100644 --- a/drivers/video/console_truetype.c +++ b/drivers/video/console_truetype.c @@ -128,38 +128,36 @@ static int console_truetype_set_row(struct udevice *dev, uint row, int clr) struct video_priv *vid_priv = dev_get_uclass_priv(dev->parent); struct console_tt_priv *priv = dev_get_priv(dev); void *end, *line; - int pixels = priv->font_size * vid_priv->line_length; - int i, ret; + int ret; line = vid_priv->fb + row * priv->font_size * vid_priv->line_length; + end = line + priv->font_size * vid_priv->line_length; + switch (vid_priv->bpix) { #ifdef CONFIG_VIDEO_BPP8 case VIDEO_BPP8: { - uint8_t *dst = line; + u8 *dst; - for (i = 0; i < pixels; i++) - *dst++ = clr; - end = dst; + for (dst = line; dst < (u8 *)end; ++dst) + *dst = clr; break; } #endif #ifdef CONFIG_VIDEO_BPP16 case VIDEO_BPP16: { - uint16_t *dst = line; + u16 *dst = line; - for (i = 0; i < pixels; i++) - *dst++ = clr; - end = dst; + for (dst = line; dst < (u16 *)end; ++dst) + *dst = clr; break; } #endif #ifdef CONFIG_VIDEO_BPP32 case VIDEO_BPP32: { - uint32_t *dst = line; + u32 *dst = line; - for (i = 0; i < pixels; i++) - *dst++ = clr; - end = dst; + for (dst = line; dst < (u32 *)end; ++dst) + *dst = clr; break; } #endif