Paths

Table of Contentst

Differential D34220

vt: fix splash_cpu logos use of vd_drawrect
ClosedPublic
Actions

Authored by sg2342_googlemail.com on Feb 9 2022, 1:27 AM.

Tags

None

Referenced Files

	Unknown Object (File)
	Tue, Aug 5, 12:24 AM

	Unknown Object (File)
	Jul 10 2025, 7:57 AM

	Unknown Object (File)
	Jul 5 2025, 1:34 AM

	Unknown Object (File)
	Jun 30 2025, 7:41 PM

	Unknown Object (File)
	Jun 26 2025, 8:02 AM

	Unknown Object (File)
	Jun 22 2025, 7:33 AM

	Unknown Object (File)
	Jun 21 2025, 6:05 PM

	Unknown Object (File)
	Jun 20 2025, 8:46 PM

Subscribers

Contributor Reviews (src)

Details

Reviewers

imp
emaste
cem

Commits

rG5fed793a5086: vt: fix splash_cpu logos use of vd_drawrect
rG06296f77c5bc: vt: fix splash_cpu logos use of vd_drawrect

Summary

This fixes a memory corruption (author clearly did not intend to write to a non-existing
pixel column).

In the (extremely unlikely) case of vd->vd_height == vt_logo_sprite_height ; the
vd_drawrect code will write outside of frame-buffer memory.

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 44364
Build 41252: arc lint + arc unit

Event Timeline

sg2342_googlemail.com created this revision.Feb 9 2022, 1:27 AM

Herald added subscribers: Contributor Reviews (src), imp. · View Herald TranscriptFeb 9 2022, 1:27 AM

sg2342_googlemail.com requested review of this revision.Feb 9 2022, 1:27 AM

Harbormaster completed remote builds in B44364: Diff 102543.Feb 9 2022, 1:27 AM

lwhsu added a subscriber: lwhsu.Feb 9 2022, 1:32 AM

sg2342_googlemail.com mentioned this in D34221: vt: implement rotation for framebuffer consoles.Feb 9 2022, 1:51 AM

sg2342_googlemail.com added reviewers: imp, emaste.Feb 9 2022, 2:29 AM

emaste added a reviewer: cem.Feb 9 2022, 2:30 AM

cem added inline comments.Feb 9 2022, 2:43 AM

sys/dev/vt/vt_cpulogos.c
139	We also want to subtract one from `vt_logo_sprite_height` as well, right? But I am a little surprised we don't do any dimension validation in `vd_drawrect` implementations s.t. we get memory corruption.

subtract one from vt_logo_sprite_height as well

Harbormaster completed remote builds in B44366: Diff 102545.Feb 9 2022, 2:47 AM

i was glad that there was no dimension validation in vt_fb_drawrect(), otherwise https://reviews.freebsd.org/D34221 would be more complicated to do.

sg2342_googlemail.com marked an inline comment as done.Feb 9 2022, 2:57 AM

In D34220#774261, @sg2342_googlemail.com wrote:

subtract one from vt_logo_sprite_height as well

Thanks.

In D34220#774265, @sg2342_googlemail.com wrote:

i was glad that there was no dimension validation in vt_fb_drawrect(), otherwise https://reviews.freebsd.org/D34221 would be more complicated to do.

I suppose you could validate in setpixel instead.

This revision is now accepted and ready to land.Feb 9 2022, 3:00 AM

Can you provide author info (for git commit --author)

Author: Stefan Grundmann <sg2342@googlemail.com>

Closed by commit rG06296f77c5bc: vt: fix splash_cpu logos use of vd_drawrect (authored by sg2342_googlemail.com, committed by emaste). · Explain WhyFeb 9 2022, 3:25 AM

This revision was automatically updated to reflect the committed changes.

emaste added a commit: rG06296f77c5bc: vt: fix splash_cpu logos use of vd_drawrect.

vidwer_fbsdbugs_gmail.com mentioned this in D30919: Automagically apply quirks on USB storage devices.Feb 9 2022, 1:33 PM

emaste added a commit: rG5fed793a5086: vt: fix splash_cpu logos use of vd_drawrect.Feb 16 2022, 12:41 AM

Revision Contents
Changeset List

Path

Size

sys/

dev/

vt/

2 lines

Diff 102543

sys/dev/vt/vt_cpulogos.c

Loading...