On 27/02/17 13:39, Bastian Stender wrote:
Moving the cursor to x=2, y=2 with "\e[3;3H" on a 12x2 framebuffer
console lead to a barebox crash while drawing the cursor. If the
cursor position is out of bounds clip the cursor to the corresponding
edge.
Signed-off-by: Bastian Stender <b...@pengutronix.de>
---
drivers/video/fbconsole.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbconsole.c b/drivers/video/fbconsole.c
index 64f7d7364e..33649c597d 100644
--- a/drivers/video/fbconsole.c
+++ b/drivers/video/fbconsole.c
@@ -264,10 +264,13 @@ static void fbc_parse_csi(struct fbc_priv *priv)
return;
case 'H':
video_invertchar(priv, priv->x, priv->y);
+
pos = simple_strtoul(priv->csi, &end, 10);
- priv->y = pos ? pos - 1 : 0;
+ priv->y = clamp(pos - 1, 0, (int) priv->rows);
+
That allows priv->y to be set to priv->rows, which is one too many.
How about:
priv->y = clamp(pos, 1, (int)priv->rows) - 1;
?
pos = simple_strtoul(end + 1, NULL, 10);
- priv->x = pos ? pos - 1 : 0;
+ priv->x = clamp(pos - 1, 0, (int) priv->cols);
+
Similar to above.
video_invertchar(priv, priv->x, priv->y);
case 'K':
pos = simple_strtoul(priv->csi, &end, 10);
--
-=( Ian Abbott @ MEV Ltd. E-mail: <abbo...@mev.co.uk> )=-
-=( Web: http://www.mev.co.uk/ )=-
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
