diff options
| author | Heinrich Schuchardt <xypron.glpk@gmx.de> | 2018-09-19 19:15:14 +0200 |
|---|---|---|
| committer | Alexander Graf <agraf@suse.de> | 2018-09-23 21:55:31 +0200 |
| commit | 4b985e0035263b62d5a0cb9de42c87171892949f (patch) | |
| tree | 3050d5892e00d4cb6f0f5b6bfd7077ed63014712 /drivers/video | |
| parent | 9d08f6db2a130a03282865ded550655b022e5ce7 (diff) | |
| download | u-boot-4b985e0035263b62d5a0cb9de42c87171892949f.tar.gz | |
dm: video: check bounds for column and row
CSI H can be used to position the cursor. The calling application may
specify a location that is beyond the limits of the screen. This may
lead to an illegal memory access.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Alexander Graf <agraf@suse.de>
Diffstat (limited to 'drivers/video')
| -rw-r--r-- | drivers/video/vidconsole-uclass.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/video/vidconsole-uclass.c b/drivers/video/vidconsole-uclass.c index f1d3ad3611..0c36a5de0a 100644 --- a/drivers/video/vidconsole-uclass.c +++ b/drivers/video/vidconsole-uclass.c @@ -213,6 +213,14 @@ static void vidconsole_escape_char(struct udevice *dev, char ch) s++; /* ; */ s = parsenum(s, &col); + /* + * Ensure we stay in the bounds of the screen. + */ + if (row >= priv->rows) + row = priv->rows - 1; + if (col >= priv->cols) + col = priv->cols - 1; + priv->ycur = row * priv->y_charsize; priv->xcur_frac = priv->xstart_frac + VID_TO_POS(col * priv->x_charsize); |