[U-Boot] [PATCH] video: bmp: check coordinates of bitmap

[Heinrich Schuchardt]

On 10/25/19 11:21 AM, Yannick Fertré wrote:
> If the coordinates are bigger than the size of
> the panel then errors appear when calculating axis alignment
> and the copy of bitmap is done outside of framebuffer.
>
> Signed-off-by: Yannick Fertré <yannick.fertre at st.com>
> ---
>  drivers/video/video_bmp.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>
> diff --git a/drivers/video/video_bmp.c b/drivers/video/video_bmp.c
> index 4af1fb4..74267f7 100644
> --- a/drivers/video/video_bmp.c
> +++ b/drivers/video/video_bmp.c
> @@ -256,6 +256,19 @@ int video_bmp_display(struct udevice *dev, ulong bmp_image, int x, int y,
>  		return -EINVAL;
>  	}
>

Below these lines that you are adding we already have code for clipping
bitmaps that are too large:

          if ((x + width) > pwidth)
                  width = pwidth - x;
          if ((y + height) > priv->ysize)
                  height = priv->ysize - y;

Why is this not working in your case?

Clipping is preferable to creating error messages. So if something is
wrong in the clipping logic this should be corrected.

Best regards

Heinrich

> +	/* check if coordinates exceeds panel size */
> +	if (pwidth < x && x != BMP_ALIGN_CENTER) {
> +		printf("Error: Coordinate x %d is bigger than panel width %d\n",
> +		       (int)x, (int)pwidth);
> +		return -EINVAL;
> +	}
> +
> +	if (priv->ysize < y && y != BMP_ALIGN_CENTER) {
> +		printf("Error: Coordinate y %d is bigger than panel height %d\n"
> +		       , (int)y, (int)priv->ysize);
> +		return -EINVAL;
> +	}
> +
>  	if (align) {
>  		video_splash_align_axis(&x, priv->xsize, width);
>  		video_splash_align_axis(&y, priv->ysize, height);
>