From 7682736c891d2b6f0cce167f4ecd55d2df0f562f Mon Sep 17 00:00:00 2001
From: "eric.gao@rock-chips.com" <eric.gao@rock-chips.com>
Date: Mon, 10 Apr 2017 10:02:20 +0800
Subject: [PATCH] video: Fix crash when scroll screen

After enabling log printing to lcd, when the screen starts
scrolling, system crashes. Log is shown as bellow:

    "Synchronous Abort" handler, esr 0x96000045
    "Synchronous Abort" handler, esr 0x96000045

Checking the source code, we found that the variable "pixels"
gets a wrong value:

    int pixels = VIDEO_FONT_HEIGHT * vid_priv->line_length;

"pixels" here means the value of pixels for a character, rather
than the bytes for a character. So the variable "pixels" is 4
times bigger than it's exact value, which will cause the memory
overflow when the cpu runs the following code:

    for (i = 0; i < pixels; i++)
        *dst++ = clr; <<----

Signed-off-by: Eric Gao <eric.gao@rock-chips.com>
---
 drivers/video/console_normal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/console_normal.c b/drivers/video/console_normal.c
index 89a55dd11d..b627d48df6 100644
--- a/drivers/video/console_normal.c
+++ b/drivers/video/console_normal.c
@@ -18,7 +18,7 @@ static int console_normal_set_row(struct udevice *dev, uint row, int clr)
 {
 	struct video_priv *vid_priv = dev_get_uclass_priv(dev->parent);
 	void *line;
-	int pixels = VIDEO_FONT_HEIGHT * vid_priv->line_length;
+	int pixels = VIDEO_FONT_HEIGHT * vid_priv->xsize;
 	int i;
 
 	line = vid_priv->fb + row * VIDEO_FONT_HEIGHT * vid_priv->line_length;
-- 
2.39.5