[PATCH v3] fbconsole: check cursor position before moving

[Ian Abbott]

On 27/02/17 13:39, Bastian Stender wrote:
> Moving the cursor to x=2, y=2 with "\e[3;3H" on a 12x2 framebuffer
> console lead to a barebox crash while drawing the cursor. If the
> cursor position is out of bounds clip the cursor to the corresponding
> edge.
>
> Signed-off-by: Bastian Stender <bst at pengutronix.de>
> ---
>  drivers/video/fbconsole.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/video/fbconsole.c b/drivers/video/fbconsole.c
> index 64f7d7364e..33649c597d 100644
> --- a/drivers/video/fbconsole.c
> +++ b/drivers/video/fbconsole.c
> @@ -264,10 +264,13 @@ static void fbc_parse_csi(struct fbc_priv *priv)
>  		return;
>  	case 'H':
>  		video_invertchar(priv, priv->x, priv->y);
> +
>  		pos = simple_strtoul(priv->csi, &end, 10);
> -		priv->y = pos ? pos - 1 : 0;
> +		priv->y = clamp(pos - 1, 0, (int) priv->rows);
> +

That allows priv->y to be set to priv->rows, which is one too many.

How about:

		priv->y = clamp(pos, 1, (int)priv->rows) - 1;

?

>  		pos = simple_strtoul(end + 1, NULL, 10);
> -		priv->x = pos ? pos - 1 : 0;
> +		priv->x = clamp(pos - 1, 0, (int) priv->cols);
> +

Similar to above.

>  		video_invertchar(priv, priv->x, priv->y);
>  	case 'K':
>  		pos = simple_strtoul(priv->csi, &end, 10);
>


-- 
-=( Ian Abbott @ MEV Ltd.    E-mail: <abbotti at mev.co.uk> )=-
-=(                          Web: http://www.mev.co.uk/  )=-