diff options
| author | Aidan MacDonald <amachronic@protonmail.com> | 2022-09-30 10:49:39 +0100 |
|---|---|---|
| committer | Aidan MacDonald <amachronic@protonmail.com> | 2022-09-30 10:49:39 +0100 |
| commit | 3bc6408bbe77b76ced68bb7711da9106ba535a55 (patch) | |
| tree | 3c2768f6367be8d92a3e7e532917ccdef12764e2 | |
| parent | f373c97c90e816404c00ab48b2e36b18fd5e6c49 (diff) | |
| download | rockbox-3bc6408bbe77b76ced68bb7711da9106ba535a55.tar.gz rockbox-3bc6408bbe77b76ced68bb7711da9106ba535a55.zip | |
lcd: Fix incorrect use of LCD_STRIDEFORMAT for remote LCDs
The get_address_fn implementations for some remote LCDs were
checking LCD_STRIDEFORMAT unconditionally, but that macro is
only valid for the main LCD. The remote LCD code only supports
horizontal strides, so when compiling for a remote LCD, force
the use of horizontal stride addressing.
This fixes a buffer overflow and out of bounds write that occurs
with the M:Robe 500 remote LCD. (Tested with sim + ASan only.)
Change-Id: I99c6aa11d38f5105b096fc448948b9ec1b27dfe6
| -rw-r--r-- | firmware/drivers/lcd-1bit-vert.c | 2 | ||||
| -rw-r--r-- | firmware/drivers/lcd-2bit-vi.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/firmware/drivers/lcd-1bit-vert.c b/firmware/drivers/lcd-1bit-vert.c index e574d4c191..49c15c041e 100644 --- a/firmware/drivers/lcd-1bit-vert.c +++ b/firmware/drivers/lcd-1bit-vert.c | |||
| @@ -83,7 +83,7 @@ static void *LCDFN(frameaddress_default)(int x, int y) | |||
| 83 | { | 83 | { |
| 84 | /* the default expects a buffer the same size as the screen */ | 84 | /* the default expects a buffer the same size as the screen */ |
| 85 | struct frame_buffer_t *fb = CURRENT_VP->buffer; | 85 | struct frame_buffer_t *fb = CURRENT_VP->buffer; |
| 86 | #if LCD_STRIDEFORMAT == VERTICAL_STRIDE | 86 | #if defined(MAIN_LCD) && LCD_STRIDEFORMAT == VERTICAL_STRIDE |
| 87 | size_t element = (x * LCDM(NATIVE_STRIDE)(fb->stride)) + y; | 87 | size_t element = (x * LCDM(NATIVE_STRIDE)(fb->stride)) + y; |
| 88 | #else | 88 | #else |
| 89 | size_t element = (y * LCDM(NATIVE_STRIDE)(fb->stride)) + x; | 89 | size_t element = (y * LCDM(NATIVE_STRIDE)(fb->stride)) + x; |
diff --git a/firmware/drivers/lcd-2bit-vi.c b/firmware/drivers/lcd-2bit-vi.c index 0bcf60767e..0580705a05 100644 --- a/firmware/drivers/lcd-2bit-vi.c +++ b/firmware/drivers/lcd-2bit-vi.c | |||
| @@ -95,7 +95,7 @@ static void *LCDFN(frameaddress_default)(int x, int y) | |||
| 95 | { | 95 | { |
| 96 | /* the default expects a buffer the same size as the screen */ | 96 | /* the default expects a buffer the same size as the screen */ |
| 97 | struct frame_buffer_t *fb = CURRENT_VP->buffer; | 97 | struct frame_buffer_t *fb = CURRENT_VP->buffer; |
| 98 | #if LCD_STRIDEFORMAT == VERTICAL_STRIDE | 98 | #if defined(MAIN_LCD) && LCD_STRIDEFORMAT == VERTICAL_STRIDE |
| 99 | size_t element = (x * LCDM(NATIVE_STRIDE)(fb->stride)) + y; | 99 | size_t element = (x * LCDM(NATIVE_STRIDE)(fb->stride)) + y; |
| 100 | #else | 100 | #else |
| 101 | size_t element = (y * LCDM(NATIVE_STRIDE)(fb->stride)) + x; | 101 | size_t element = (y * LCDM(NATIVE_STRIDE)(fb->stride)) + x; |