vt: fix splash_cpu logos use of vd_drawrect

[sg2342_googlemail.com]

Summary

This fixes a memory corruption (author clearly did not intend to write to a non-existing
pixel column).

In the (extremely unlikely) case of vd->vd_height == vt_logo_sprite_height ; the
vd_drawrect code will write outside of frame-buffer memory.

[cem]

sys/dev/vt/vt_cpulogos.c

138–139

We also want to subtract one from vt_logo_sprite_height as well, right?

But I am a little surprised we don't do any dimension validation in vd_drawrect implementations s.t. we get memory corruption.

[sg2342_googlemail.com]

subtract one from vt_logo_sprite_height as well

[sg2342_googlemail.com]

i was glad that there was no dimension validation in vt_fb_drawrect(), otherwise https://reviews.freebsd.org/D34221 would be more complicated to do.

[cem]

In D34220#774261, @sg2342_googlemail.com wrote:

subtract one from vt_logo_sprite_height as well

Thanks.

In D34220#774265, @sg2342_googlemail.com wrote:

i was glad that there was no dimension validation in vt_fb_drawrect(), otherwise https://reviews.freebsd.org/D34221 would be more complicated to do.

I suppose you could validate in setpixel instead.

[emaste]

Can you provide author info (for git commit --author)

[sg2342_googlemail.com]

Author: Stefan Grundmann <[e-mail]>