diff options
| author | Wolfgang Denk <wd@denx.de> | 2011-04-28 23:45:16 +0200 |
|---|---|---|
| committer | Wolfgang Denk <wd@denx.de> | 2011-04-28 23:45:16 +0200 |
| commit | 1911602b68f9f6cb2b11dde460aa42d17fb1f700 (patch) | |
| tree | 8f6aa78248b08b47582e00548eb5069466e0f82e /drivers/video/cfb_console.c | |
| parent | 34d9cb5ec69ce856c3d241d9416620f721d45892 (diff) | |
| parent | ba8e76bd49a0575a2442025507882b499856af2b (diff) | |
| download | olio-uboot-2014.01-1911602b68f9f6cb2b11dde460aa42d17fb1f700.tar.xz olio-uboot-2014.01-1911602b68f9f6cb2b11dde460aa42d17fb1f700.zip | |
Merge branch 'master' of git://git.denx.de/u-boot-video
Diffstat (limited to 'drivers/video/cfb_console.c')
| -rw-r--r-- | drivers/video/cfb_console.c | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/drivers/video/cfb_console.c b/drivers/video/cfb_console.c index dd849c2dc..b427c8487 100644 --- a/drivers/video/cfb_console.c +++ b/drivers/video/cfb_console.c @@ -882,6 +882,8 @@ static int display_rle8_bitmap (bmp_image_t *img, int xoff, int yoff, struct palette p[256]; bmp_color_table_entry_t cte; int green_shift, red_off; + int limit = VIDEO_COLS * VIDEO_ROWS; + int pixels = 0; x = 0; y = __le32_to_cpu(img->header.height) - 1; @@ -962,6 +964,10 @@ static int display_rle8_bitmap (bmp_image_t *img, int xoff, int yoff, /* unencoded run */ cnt = bm[1]; runlen = cnt; + pixels += cnt; + if (pixels > limit) + goto error; + bm += 2; if (y < height) { if (x >= width) { @@ -970,7 +976,6 @@ static int display_rle8_bitmap (bmp_image_t *img, int xoff, int yoff, } if (x + runlen > width) cnt = width - x; - draw_bitmap (&fbp, bm, p, cnt, 0); x += runlen; } @@ -982,9 +987,13 @@ next_run: break; default: /* encoded run */ + cnt = bm[0]; + runlen = cnt; + pixels += cnt; + if (pixels > limit) + goto error; + if (y < height) { /* only draw into visible area */ - cnt = bm[0]; - runlen = cnt; if (x >= width) { x += runlen; bm += 2; @@ -992,7 +1001,6 @@ next_run: } if (x + runlen > width) cnt = width - x; - draw_bitmap (&fbp, bm, p, cnt, 1); x += runlen; } @@ -1001,6 +1009,9 @@ next_run: } } return 0; +error: + printf("Error: Too much encoded pixel data, validate your bitmap\n"); + return -1; } #endif |