Nyaaori/rockbox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

lcd_putsxyofs 16 bit lcd_mono_bitmap_part [AS] part duex

Browse source 
'Bugfix' mono_bitmap_part reads ahead in the buffer,
if the height is <= char bit pixels other memory gets read
found with [Address Sanitizer]

also g#3332 since this is clearly a problem across the code
instead place the check for height < 8 in the lcd_mono_bitmap_part function

second try places the check above the negative y offset
this was causing glitches on the Q1 and likely other TS targets
since a negative y was added to height it made it < CHAR_BIT setting
stride = 0 even though the bitmap was >= CHAR_BIT high

Change-Id: I13bb8ab472c2ae61302a6de5d9e2c78243354460
This commit is contained in:
William Wilgus 2021-08-25 22:18:14 -04:00 committed by William Wilgus
parent 30e96a3732
commit cab8cea0f0
1 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
firmware/drivers/lcd-16bit-common.c
View file

@ -330,6 +330,15 @@ void ICODE_ATTR lcd_mono_bitmap_part(const unsigned char *src, int src_x,
src_x -= x;
x = 0;
}
/* 'Bugfix' mono_bitmap_part reads ahead in the buffer,
* if the height is <= char bit pixels other memory gets read
* the other option is to check in the hot code path but this appears
* sufficient
*/
if (height <= CHAR_BIT)
stride = 0;
if (y < 0)
{
height += y;
@ -341,13 +350,11 @@ void ICODE_ATTR lcd_mono_bitmap_part(const unsigned char *src, int src_x,
if (y + height > LCD_HEIGHT)
height = LCD_HEIGHT - y;
#endif
src += stride * (src_y >> 3) + src_x; /* move starting point */
src_y &= 7;
src_end = src + width;
dst_col = FBADDR(x, y);
if (drmode & DRMODE_INVERSEVID)
{
dmask = 0x1ff; /* bit 8 == sentinel */
@ -462,14 +469,7 @@ void ICODE_ATTR lcd_mono_bitmap_part(const unsigned char *src, int src_x,
/* Draw a full monochrome bitmap */
void lcd_mono_bitmap(const unsigned char *src, int x, int y, int width, int height)
{
int stride = width;
/* 'Bugfix' mono_bitmap_part reads ahead in the buffer,
* if the height is <= char bit pixels other memory gets read
*/
if (height <= CHAR_BIT)
stride = 0;
lcd_mono_bitmap_part(src, 0, 0, stride, x, y, width, height);
lcd_mono_bitmap_part(src, 0, 0, width, x, y, width, height);
}