Page MenuHomeFreeBSD

vt: fix splash_cpu logos use of vd_drawrect
ClosedPublic

Authored by sg2342_googlemail.com on Feb 9 2022, 1:27 AM.

Details

Summary

This fixes a memory corruption (author clearly did not intend to write to a non-existing
pixel column).

In the (extremely unlikely) case of vd->vd_height == vt_logo_sprite_height ; the
vd_drawrect code will write outside of frame-buffer memory.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

sys/dev/vt/vt_cpulogos.c
138–139

We also want to subtract one from vt_logo_sprite_height as well, right?

But I am a little surprised we don't do any dimension validation in vd_drawrect implementations s.t. we get memory corruption.

subtract one from vt_logo_sprite_height as well

i was glad that there was no dimension validation in vt_fb_drawrect(), otherwise https://reviews.freebsd.org/D34221 would be more complicated to do.

subtract one from vt_logo_sprite_height as well

Thanks.

i was glad that there was no dimension validation in vt_fb_drawrect(), otherwise https://reviews.freebsd.org/D34221 would be more complicated to do.

I suppose you could validate in setpixel instead.

This revision is now accepted and ready to land.Feb 9 2022, 3:00 AM

Can you provide author info (for git commit --author)

Author: Stefan Grundmann <sg2342@googlemail.com>

This revision was automatically updated to reflect the committed changes.