From 9db24694ca16506ad7f4a1205648a2a9cf550734 Mon Sep 17 00:00:00 2001 From: Blue Swirl Date: Wed, 29 Sep 2010 18:34:41 +0000 Subject: [PATCH] video: improve boundary checking Add checks to fill_rect() and video_scroll(). Signed-off-by: Blue Swirl git-svn-id: svn://coreboot.org/openbios/trunk/openbios-devel@871 f158a5a8-5612-0410-a976-696ce0be7e32 --- packages/video.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/packages/video.c b/packages/video.c index 7aef786..d1639ed 100644 --- a/packages/video.c +++ b/packages/video.c @@ -142,7 +142,8 @@ fill_rect( int col_ind, int x, int y, int w, int h ) char *pp; unsigned long col = get_color(col_ind); - if( !video.has_video || x < 0 || y < 0 || x+w > video.fb.w || y+h > video.fb.h ) + if (!video.has_video || x < 0 || y < 0 || w <= 0 || h <= 0 || + x + w > video.fb.w || y + h > video.fb.h) return; pp = (char*)video.fb.mphys + video.fb.rb * y; @@ -203,6 +204,9 @@ video_scroll( int height ) { int i, offs, size, *dest, *src; + if (height <= 0 || height >= video.fb.h) { + return; + } offs = video.fb.rb * height; size = (video.fb.h * video.fb.rb - offs)/16; dest = (int*)video.fb.mphys;