[PATCH] vga16fb: test virtual screen range before subtraction on unsigned

[PATCH] vga16fb: test virtual screen range before subtraction on unsigned

[Roel Kluin]

dx and dy are u32's, so the test should occur before the subtraction

Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
---
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 9b3c592..9d27517 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1087,12 +1087,15 @@ static void vga16fb_copyarea(struct fb_info *info, const struct fb_copyarea *are
 	width = x2 - dx;
 	height = y2 - dy;
 
+	if (sx + dx < old_dx || sy + dy < old_dy)
+		return;
+
 	/* update sx1,sy1 */
 	sx += (dx - old_dx);
 	sy += (dy - old_dy);
 
 	/* the source must be completely inside the virtual screen */
-	if (sx < 0 || sy < 0 || (sx + width) > vxres || (sy + height) > vyres)
+	if (sx + width > vxres || sy + height > vyres)
 		return;
 
 	switch (info->fix.type) {

[PATCH] atafb: test virtual screen range before subtraction on unsigned

[Roel Kluin]

a bit similar to vga16fb,
---
dx and dy are u32's, so the test should occur before the subtraction

Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
---
diff --git a/drivers/video/atafb.c b/drivers/video/atafb.c
index 5d4fbaa..8f60a8f 100644
--- a/drivers/video/atafb.c
+++ b/drivers/video/atafb.c
@@ -2593,13 +2593,16 @@ static void atafb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
 	width = x2 - dx;
 	height = y2 - dy;
 
+	if (area->sx + dx < area->dx || area->sy + dy < area->dy)
+		return;
+
 	/* update sx,sy */
 	sx = area->sx + (dx - area->dx);
 	sy = area->sy + (dy - area->dy);
 
 	/* the source must be completely inside the virtual screen */
-	if (sx < 0 || sy < 0 || (sx + width) > info->var.xres_virtual ||
-	    (sy + height) > info->var.yres_virtual)
+	if (sx + width > info->var.xres_virtual ||
+			sy + height > info->var.yres_virtual)
 		return;
 
 	if (dy > sy || (dy == sy && dx > sx)) {

[PATCH] amifb: test virtual screen range before subtraction on unsigned

[Roel Kluin]

and another,
---
dx and dy are u32's, so the test should occur before the subtraction

Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
---
diff --git a/drivers/video/amifb.c b/drivers/video/amifb.c
index 4c9ec3f..cc62349 100644
--- a/drivers/video/amifb.c
+++ b/drivers/video/amifb.c
@@ -2048,13 +2048,16 @@ static void amifb_copyarea(struct fb_info *info,
 	width = x2 - dx;
 	height = y2 - dy;
 
+	if (area->sx + dx < area->dx || area->sy + dy < area->dy)
+		return;
+
 	/* update sx,sy */
 	sx = area->sx + (dx - area->dx);
 	sy = area->sy + (dy - area->dy);
 
 	/* the source must be completely inside the virtual screen */
-	if (sx < 0 || sy < 0 || (sx + width) > info->var.xres_virtual ||
-	    (sy + height) > info->var.yres_virtual)
+	if (sx + width > info->var.xres_virtual ||
+			sy + height > info->var.yres_virtual)
 		return;
 
 	if (dy > sy || (dy == sy && dx > sx)) {


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

Re: [PATCH] atafb: test virtual screen range before subtraction on unsigned

[Geert Uytterhoeven]

On Wed, 23 Apr 2008, Roel Kluin wrote:
> a bit similar to vga16fb,
> ---
> dx and dy are u32's, so the test should occur before the subtraction

Note that fb_copyarea.d[xy] are also u32, while there are many tests
that check for these fields being negative.

> Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
> ---
> diff --git a/drivers/video/atafb.c b/drivers/video/atafb.c
> index 5d4fbaa..8f60a8f 100644
> --- a/drivers/video/atafb.c
> +++ b/drivers/video/atafb.c
> @@ -2593,13 +2593,16 @@ static void atafb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
>  	width = x2 - dx;
>  	height = y2 - dy;
>  
> +	if (area->sx + dx < area->dx || area->sy + dy < area->dy)
> +		return;
> +
>  	/* update sx,sy */
>  	sx = area->sx + (dx - area->dx);
>  	sy = area->sy + (dy - area->dy);
>  
>  	/* the source must be completely inside the virtual screen */
> -	if (sx < 0 || sy < 0 || (sx + width) > info->var.xres_virtual ||
> -	    (sy + height) > info->var.yres_virtual)
> +	if (sx + width > info->var.xres_virtual ||
> +			sy + height > info->var.yres_virtual)
>  		return;
>  
>  	if (dy > sy || (dy == sy && dx > sx)) {
> 

Gr{oetje,eeting}s,

						Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
							    -- Linus Torvalds

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone