android_kernel_motorola_sm6375/drivers/video
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Albin Babu Varghese 996bfaa737 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]

Add bounds checking to prevent writes past framebuffer boundaries when
rendering text near screen edges. Return early if the Y position is off-screen
and clip image height to screen boundary. Break from the rendering loop if the
X position is off-screen. When clipping image width to fit the screen, update
the character count to match the clipped width to prevent buffer size
mismatches.

Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
receive mismatched parameters where the buffer is allocated for the clipped
width but cnt reflects the original larger count, causing out-of-bounds writes.

Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
Suggested-by: Helge Deller <deller@gmx.de>
Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-12-03 12:45:15 +01:00
..
backlight video: backlight: lp855x_bl: Set correct EPROM start for LP8556 2025-12-03 12:45:07 +01:00
console Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" 2025-08-28 16:21:31 +02:00
fbdev fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds 2025-12-03 12:45:15 +01:00
logo
display_timing.c
hdmi.c
Kconfig
Makefile
of_display_timing.c
of_videomode.c
vgastate.c
videomode.c