vt: incomplete initialization of vc_tab_stop
PATCH 1/1 vt: incomplete initialization of vc_tab_stop
Problem 1 (see patch below):
vc_tab_stop is declared as an array of 8 unsigned ints in struct vc_data in include/linux/console_struct.h .
In drivers/char/vt.c only 5 of these 8 unsigned ints get initialized leading to unintended tabulator placement on displays with more than 160 columns text.
Problem 2 (open):
Upcoming displays will have more than 256 columns of text leading to invalid memory access in drivers/char/vt.c during tabulator calculations:
if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31))) break;
---
drivers/char/vt.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-)
drivers/char/vt.c +8 -2
@@ -1644,7 +1644,10 @@ static void reset_terminal(struct vc_data *vc, int do_clear) vc->vc_tab_stop[1 ] = vc->vc_tab_stop[2 ] = vc->vc_tab_stop[3 ] = - vc->vc_tab_stop[4 ] =0x01010101 ; + vc->vc_tab_stop[4 ] = + vc->vc_tab_stop[5 ] = + vc->vc_tab_stop[6 ] = + vc->vc_tab_stop[7 ] =0x01010101 ; vc->vc_bell_pitch =DEFAULT_BELL_PITCH ; vc->vc_bell_duration =DEFAULT_BELL_DURATION ;
@@ -1935,7 +1938,10 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) vc->vc_tab_stop[1 ] = vc->vc_tab_stop[2 ] = vc->vc_tab_stop[3 ] = - vc->vc_tab_stop[4 ] =0 ; + vc->vc_tab_stop[4 ] = + vc->vc_tab_stop[5 ] = + vc->vc_tab_stop[6 ] = + vc->vc_tab_stop[7 ] =0 ; }return ;case 'm' :
drivers/char/vt.c static void reset_terminal(struct vc_data *vc, int do_clear)
Quoted 13 lines · Wolfgang Kroworsch
drivers/char/vt.c +8
-1vc->vc_tab_stop[1 ] = vc->vc_tab_stop[2 ] = vc->vc_tab_stop[3 ] = - vc->vc_tab_stop[4 ] =0x01010101 ; + vc->vc_tab_stop[4 ] = + vc->vc_tab_stop[5 ] = + vc->vc_tab_stop[6 ] = + vc->vc_tab_stop[7 ] =0x01010101 ; + vc->vc_tab_stop[4 ] = + vc->vc_tab_stop[5 ] = + vc->vc_tab_stop[6 ] = + vc->vc_tab_stop[7 ] =0 ;
Using memset might be a beter idea.
Quoted 6 lines · On Sat, 18 Oct 2008 13:49:31 +0200 Wolfgang Kroworsch <[email protected]>…
Problem 1 (see patch below):
vc_tab_stopis declared as an array of 8 unsigned ints in structvc_dataininclude/linux/console_struct.h.
Indrivers/char/vt.conly 5 of these 8 unsigned ints get initialized leading to unintended tabulator placement on displays with more than 160 columns text.
Seems sensible enough - but need a Signed-off-by line to apply.
Quoted 7 lines
Problem 2 (open):
Upcoming displays will have more than 256 columns of text leading to invalid memory access indrivers/char/vt.cduring tabulator calculations:if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31))) break;
Yes. We should either limit the vt size or grow the tables.
Alan
Quoted 10 lines · On Wed, Oct 22, 2008 at 11:27:05AM +0100 Alan Cox wrote:
Quoted 6 lines · On Sat, 18 Oct 2008 13:49:31 +0200 Wolfgang Kroworsch wrote:
Problem 1 (see patch below):
vc_tab_stopis declared as an array of 8 unsigned ints in structvc_dataininclude/linux/console_struct.h.
Indrivers/char/vt.conly 5 of these 8 unsigned ints get initialized leading to unintended tabulator placement on displays with more than 160 columns text.Seems sensible enough - but need a Signed-off-by line to apply.
Thx, Wolfgang
---
drivers/char/vt.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-)
drivers/char/vt.c +8 -2
@@ -1644,7 +1644,10 @@ static void reset_terminal(struct vc_data *vc, int do_clear) vc->vc_tab_stop[1 ] = vc->vc_tab_stop[2 ] = vc->vc_tab_stop[3 ] = - vc->vc_tab_stop[4 ] =0x01010101 ; + vc->vc_tab_stop[4 ] = + vc->vc_tab_stop[5 ] = + vc->vc_tab_stop[6 ] = + vc->vc_tab_stop[7 ] =0x01010101 ; vc->vc_bell_pitch =DEFAULT_BELL_PITCH ; vc->vc_bell_duration =DEFAULT_BELL_DURATION ;
@@ -1935,7 +1938,10 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) vc->vc_tab_stop[1 ] = vc->vc_tab_stop[2 ] = vc->vc_tab_stop[3 ] = - vc->vc_tab_stop[4 ] =0 ; + vc->vc_tab_stop[4 ] = + vc->vc_tab_stop[5 ] = + vc->vc_tab_stop[6 ] = + vc->vc_tab_stop[7 ] =0 ; }return ;case 'm' :