Skip to contentSkip to conversation

vga16fb: test virtual screen range before subtraction on unsigned

PATCH New Roel Kluin 2 participants 4 messages Apr 23, 2008 – Apr 24, 2008 Framebuffer layer

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 vga16fb: test virtual screen range before subtraction on unsigned

dx and dy are u32's, so the test should occur before the subtraction

Signed-off-by Roel Kluin <[email protected]>

---

drivers/video/vga16fb.c +4 -1
index 9b3c592..9d27517 100644
@@ -1087,12 +1087,15 @@ static void vga16fb_copyarea(struct fb_info *info, const struct fb_copyarea *are
 	width = x2 - dx;
 	height = y2 - dy;
 
+	if (sx + dx < old_dx || sy + dy < old_dy)
+		return;
+
 	/* update sx1,sy1 */
 	sx += (dx - old_dx);
 	sy += (dy - old_dy);
 
 	/* the source must be completely inside the virtual screen */
-	if (sx < 0 || sy < 0 || (sx + width) > vxres || (sy + height) > vyres)
+	if (sx + width > vxres || sy + height > vyres)
 		return;
 
 	switch (info->fix.type) {
author
#1 lore raw

PATCH 1/1 atafb: test virtual screen range before subtraction on unsigned

a bit similar to vga16fb,
---
dx and dy are u32's, so the test should occur before the subtraction

Signed-off-by Roel Kluin <[email protected]>

---

drivers/video/atafb.c +5 -2
index 5d4fbaa..8f60a8f 100644
@@ -2593,13 +2593,16 @@ static void atafb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
 	width = x2 - dx;
 	height = y2 - dy;
 
+	if (area->sx + dx < area->dx || area->sy + dy < area->dy)
+		return;
+
 	/* update sx,sy */
 	sx = area->sx + (dx - area->dx);
 	sy = area->sy + (dy - area->dy);
 
 	/* the source must be completely inside the virtual screen */
-	if (sx < 0 || sy < 0 || (sx + width) > info->var.xres_virtual ||
-	    (sy + height) > info->var.yres_virtual)
+	if (sx + width > info->var.xres_virtual ||
+			sy + height > info->var.yres_virtual)
 		return;
 
 	if (dy > sy || (dy == sy && dx > sx)) {
#2 lore raw

Re: [Linux-fbdev-devel] [PATCH] atafb: test virtual screen range before subtraction on unsigned

Quoted 3 lines · Roel Kluin

a bit similar to vga16fb,
---
dx and dy are u32's, so the test should occur before the subtraction

Note that fb_copyarea.d[xy] are also u32, while there are many tests that check for these fields being negative.

Quoted 16 lines
Signed-off-by Roel Kluin <[email protected]>

---

drivers/video/atafb.c +3 -0
index 5d4fbaa..8f60a8f 100644
@@ -2593,13 +2593,16 @@ static void atafb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
 	width = x2 - dx;
 	height = y2 - dy;
 
+	if (area->sx + dx < area->dx || area->sy + dy < area->dy)
+		return;
+
 	/* update sx,sy */
 	sx = area->sx + (dx - area->dx);

drivers/video/atafb.c static void atafb_copyarea(struct fb_info *info, const struct fb_copyarea *area) · line 2608

Quoted 10 lines
drivers/video/atafb.c +2 -2
 	sy = area->sy + (dy - area->dy);
 
 	/* the source must be completely inside the virtual screen */
-	if (sx < 0 || sy < 0 || (sx + width) > info->var.xres_virtual ||
-	    (sy + height) > info->var.yres_virtual)
+	if (sx + width > info->var.xres_virtual ||
+			sy + height > info->var.yres_virtual)
 		return;
 
 	if (dy > sy || (dy == sy && dx > sx)) {

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]

In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

author
#3 lore raw

PATCH 1/1 amifb: test virtual screen range before subtraction on unsigned

In reply to Roel Kluin

and another,
---
dx and dy are u32's, so the test should occur before the subtraction

Signed-off-by Roel Kluin <[email protected]>

---

drivers/video/amifb.c +5 -2
index 4c9ec3f..cc62349 100644
@@ -2048,13 +2048,16 @@ static void amifb_copyarea(struct fb_info *info,
 	width = x2 - dx;
 	height = y2 - dy;
 
+	if (area->sx + dx < area->dx || area->sy + dy < area->dy)
+		return;
+
 	/* update sx,sy */
 	sx = area->sx + (dx - area->dx);
 	sy = area->sy + (dy - area->dy);
 
 	/* the source must be completely inside the virtual screen */
-	if (sx < 0 || sy < 0 || (sx + width) > info->var.xres_virtual ||
-	    (sy + height) > info->var.yres_virtual)
+	if (sx + width > info->var.xres_virtual ||
+			sy + height > info->var.yres_virtual)
 		return;
 
 	if (dy > sy || (dy == sy && dx > sx)) {

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone