[U-Boot] [PATCH 1/1] dm: video: check bounds for column and row

[U-Boot] [PATCH 1/1] dm: video: check bounds for column and row

[Heinrich Schuchardt]

CSI H can be used to position the cursor. The calling application may
specify a location that is beyond the limits of the screen. This may
lead to an illegal memory access.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 drivers/video/vidconsole-uclass.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/video/vidconsole-uclass.c b/drivers/video/vidconsole-uclass.c
index f1d3ad3611..0c36a5de0a 100644
--- a/drivers/video/vidconsole-uclass.c
+++ b/drivers/video/vidconsole-uclass.c
@@ -213,6 +213,14 @@ static void vidconsole_escape_char(struct udevice *dev, char ch)
 		s++;    /* ; */
 		s = parsenum(s, &col);
 
+		/*
+		 * Ensure we stay in the bounds of the screen.
+		 */
+		if (row >= priv->rows)
+			row = priv->rows - 1;
+		if (col >= priv->cols)
+			col = priv->cols - 1;
+
 		priv->ycur = row * priv->y_charsize;
 		priv->xcur_frac = priv->xstart_frac +
 			VID_TO_POS(col * priv->x_charsize);
-- 
2.18.0

[U-Boot] [PATCH 1/1] dm: video: check bounds for column and row

[Alexander Graf]

On 19.09.18 19:15, Heinrich Schuchardt wrote:
> CSI H can be used to position the cursor. The calling application may
> specify a location that is beyond the limits of the screen. This may
> lead to an illegal memory access.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

Reviewed-by: Alexander Graf <agraf@suse.de>

I'll be happy to take this in via efi-next if nobody beats me to it, as
it fixes a test failure we're not triggering otherwise.


Alex

> ---
>  drivers/video/vidconsole-uclass.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/video/vidconsole-uclass.c b/drivers/video/vidconsole-uclass.c
> index f1d3ad3611..0c36a5de0a 100644
> --- a/drivers/video/vidconsole-uclass.c
> +++ b/drivers/video/vidconsole-uclass.c
> @@ -213,6 +213,14 @@ static void vidconsole_escape_char(struct udevice *dev, char ch)
>  		s++;    /* ; */
>  		s = parsenum(s, &col);
>  
> +		/*
> +		 * Ensure we stay in the bounds of the screen.
> +		 */
> +		if (row >= priv->rows)
> +			row = priv->rows - 1;
> +		if (col >= priv->cols)
> +			col = priv->cols - 1;
> +
>  		priv->ycur = row * priv->y_charsize;
>  		priv->xcur_frac = priv->xstart_frac +
>  			VID_TO_POS(col * priv->x_charsize);
> 

[U-Boot] [PATCH 1/1] dm: video: check bounds for column and row

[Anatolij Gustschin]

On Wed, 19 Sep 2018 19:15:14 +0200
Heinrich Schuchardt xypron.glpk at gmx.de wrote:

> CSI H can be used to position the cursor. The calling application may
> specify a location that is beyond the limits of the screen. This may
> lead to an illegal memory access.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> ---
>  drivers/video/vidconsole-uclass.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

Applied to u-boot-video/master, thanks!

--
Anatolij

[U-Boot] [PATCH 1/1] dm: video: check bounds for column and row

[Anatolij Gustschin]

On Sun, 23 Sep 2018 13:35:16 +0200
Alexander Graf agraf at suse.de wrote:
...
> I'll be happy to take this in via efi-next if nobody beats me to it, as
> it fixes a test failure we're not triggering otherwise.

I've applied this to video tree since later video patches depend on it.
Thanks,

--
Anatolij