From: eric.gao@rock-chips.com <eric.gao@rock-chips.com>
Date: Mon, 10 Apr 2017 02:02:20 +0000 (+0800)
Subject: video: Fix crash when scroll screen
X-Git-Tag: v2025.01-rc5-pxa1908~7174^2
X-Git-Url: http://git.dujemihanovic.xyz/img/static/%7B%7B%20%24.Site.BaseURL%20%7D%7Dposts/%7B%7B%20%24style.RelPermalink%20%7D%7D?a=commitdiff_plain;h=7682736c891d2b6f0cce167f4ecd55d2df0f562f;p=u-boot.git

video: Fix crash when scroll screen

After enabling log printing to lcd, when the screen starts
scrolling, system crashes. Log is shown as bellow:

    "Synchronous Abort" handler, esr 0x96000045
    "Synchronous Abort" handler, esr 0x96000045

Checking the source code, we found that the variable "pixels"
gets a wrong value:

    int pixels = VIDEO_FONT_HEIGHT * vid_priv->line_length;

"pixels" here means the value of pixels for a character, rather
than the bytes for a character. So the variable "pixels" is 4
times bigger than it's exact value, which will cause the memory
overflow when the cpu runs the following code:

    for (i = 0; i < pixels; i++)
        *dst++ = clr; <<----

Signed-off-by: Eric Gao <eric.gao@rock-chips.com>
---

diff --git a/drivers/video/console_normal.c b/drivers/video/console_normal.c
index 89a55dd11d..b627d48df6 100644
--- a/drivers/video/console_normal.c
+++ b/drivers/video/console_normal.c
@@ -18,7 +18,7 @@ static int console_normal_set_row(struct udevice *dev, uint row, int clr)
 {
 	struct video_priv *vid_priv = dev_get_uclass_priv(dev->parent);
 	void *line;
-	int pixels = VIDEO_FONT_HEIGHT * vid_priv->line_length;
+	int pixels = VIDEO_FONT_HEIGHT * vid_priv->xsize;
 	int i;
 
 	line = vid_priv->fb + row * VIDEO_FONT_HEIGHT * vid_priv->line_length;