diff options
| author | Antonino A. Daplas <adaplas@gmail.com> | 2005-09-15 15:34:33 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-09-15 17:24:09 +0200 |
| commit | 065d9cac98a5406ecd5a1368f8fd38f55739dee9 (patch) | |
| tree | 07ee4a0bf1eba87e704073bd95bac25022cb5a52 /drivers/char | |
| parent | [PATCH] vgacon: Fix sanity checking in vgacon_resize (diff) | |
| download | linux-065d9cac98a5406ecd5a1368f8fd38f55739dee9.tar.xz linux-065d9cac98a5406ecd5a1368f8fd38f55739dee9.zip | |
[PATCH] vc: Use correct size on buffer copy in vc_resize
In the unlikely case of the new screen width much wider then the old,
use (old_row_size * new_rows) instead of new_screen_size to prevent a
buffer overrun during the copy.
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/vt.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/char/vt.c b/drivers/char/vt.c index 1e33cb032e07..e91268e86833 100644 --- a/drivers/char/vt.c +++ b/drivers/char/vt.c @@ -810,13 +810,14 @@ int vc_resize(struct vc_data *vc, unsigned int cols, unsigned int lines) * from the top and bottom of cursor position */ old_origin += (vc->vc_y - new_rows/2) * old_row_size; - end = old_origin + new_screen_size; + end = old_origin + (old_row_size * new_rows); } } else /* * Cursor near the top, copy contents from the top of buffer */ - end = (old_rows > new_rows) ? old_origin + new_screen_size : + end = (old_rows > new_rows) ? old_origin + + (old_row_size * new_rows) : vc->vc_scr_end; update_attr(vc); |