MFC r359626: vt: avoid overrun when stride is not a multiple of bytes…

… per pixel PR: 243533 Submitted by: Thomas Skibo
freebsd · Apr 25, 2020 · 4d9ded6 · 4d9ded6
1 parent 4b2f876
commit 4d9ded6
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/sys/dev/vt/hw/fb/vt_fb.c b/sys/dev/vt/hw/fb/vt_fb.c
@@ -234,12 +234,12 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
 		break;
 	case 2:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 2)
+			for (o = 0; o < info->fb_stride - 1; o += 2)
 				vt_fb_mem_wr2(info, h*info->fb_stride + o, c);
 		break;
 	case 3:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 3) {
+			for (o = 0; o < info->fb_stride - 2; o += 3) {
 				vt_fb_mem_wr1(info, h*info->fb_stride + o,
 				    (c >> 16) & 0xff);
 				vt_fb_mem_wr1(info, h*info->fb_stride + o + 1,
@@ -250,7 +250,7 @@ vt_fb_blank(struct vt_device *vd, term_color_t color)
 		break;
 	case 4:
 		for (h = 0; h < info->fb_height; h++)
-			for (o = 0; o < info->fb_stride; o += 4)
+			for (o = 0; o < info->fb_stride - 3; o += 4)
 				vt_fb_mem_wr4(info, h*info->fb_stride + o, c);
 		break;
 	default: