sergiotarxz/nuttx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

drivers/lcd: ssd1306: fix memory corruption caused by ssd1306_getrun(). ssd1306_getrun was writing one extra byte (with value 0) past target buffer when pixlen is multiple of 8. When pixlen was not multiple of 8, last byte of buffer was fully cleared, instead of modifying only the (pixlen % 8) bits of last byte.

Browse Source
This commit is contained in:
ussi Kivilinna 2017-08-22 08:42:40 -06:00 committed by Gregory Nutt
parent 3dfeb9e59f
commit 89cc4741ac
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/lcd/ssd1306_base.c
View File

@ -569,7 +569,6 @@ static int ssd1306_getrun(fb_coord_t row, fb_coord_t col, FAR uint8_t *buffer,
usrmask = LS_BIT;
#endif
*buffer = 0;
for (i = 0; i < pixlen; i++)
{
/* Set or clear the corresponding bit */
@ -583,17 +582,17 @@ static int ssd1306_getrun(fb_coord_t row, fb_coord_t col, FAR uint8_t *buffer,
{
*buffer |= usrmask;
}
else
{
*buffer &= ~usrmask;
}
/* Inc/Decrement to the next destination pixel. Hmmmm. It looks like
* this logic could write past the end of the user buffer. Revisit
* this!
*/
/* Inc/Decrement to the next destination pixel. */
#ifdef CONFIG_NX_PACKEDMSFIRST
if (usrmask == LS_BIT)
{
buffer++;
*buffer = 0;
usrmask = MS_BIT;
}
else
@ -604,7 +603,6 @@ static int ssd1306_getrun(fb_coord_t row, fb_coord_t col, FAR uint8_t *buffer,
if (usrmask == MS_BIT)
{
buffer++;
*buffer = 0;
usrmask = LS_BIT;
}
else