Commit a6f30cd
committed
Fix heap corruption caused by specifying an x value outside of display
Bug:
The memory corruption occurs during the memset call in the erase
routine. When bad values are in drawBitmap the number of bytes to zero
is too long by 1 byte. These values are updated by several macros, one
of which is pageCheckBoundsRange. The values passed to this macro
should be x values that match physical pixels on the screen. However
calls to drawBitmap was using the number of screen pixels or width to
offset the current x value resulting in the next pixel (not updated)
instead of the last pixel (updated). When the bitmap or a portion of
the bitmap is at the edge of the screen, this results in an invalid x
value outside the range of (0 <= x < width).
Fix:
* Compute the last updated pixel offset for the pageCheckBoundsRange in
drawBitmap
* Add comments to pageCheckBounds* macros to specify bounds in hopes of
avoiding a similar issue in the future1 parent 9709716 commit a6f30cd
1 file changed
Lines changed: 7 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
130 | 130 | | |
131 | 131 | | |
132 | 132 | | |
| 133 | + | |
| 134 | + | |
133 | 135 | | |
134 | 136 | | |
135 | 137 | | |
| |||
140 | 142 | | |
141 | 143 | | |
142 | 144 | | |
| 145 | + | |
| 146 | + | |
143 | 147 | | |
144 | 148 | | |
145 | 149 | | |
| |||
150 | 154 | | |
151 | 155 | | |
152 | 156 | | |
| 157 | + | |
153 | 158 | | |
154 | 159 | | |
155 | 160 | | |
| |||
880 | 885 | | |
881 | 886 | | |
882 | 887 | | |
883 | | - | |
| 888 | + | |
884 | 889 | | |
885 | 890 | | |
886 | 891 | | |
| |||
1014 | 1019 | | |
1015 | 1020 | | |
1016 | 1021 | | |
1017 | | - | |
| 1022 | + | |
0 commit comments