Moving the cursor to x=2, y=2 with "\e[3;3H" on a 12x2 framebuffer console lead to a barebox crash while drawing the cursor. The cursor can only be moved to a valid position between (0,0) and (priv->cols, priv->rows) now. Signed-off-by: Bastian Stender <bst@xxxxxxxxxxxxxx> --- drivers/video/fbconsole.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbconsole.c b/drivers/video/fbconsole.c index 64f7d7364e..3879741b2a 100644 --- a/drivers/video/fbconsole.c +++ b/drivers/video/fbconsole.c @@ -264,10 +264,13 @@ static void fbc_parse_csi(struct fbc_priv *priv) return; case 'H': video_invertchar(priv, priv->x, priv->y); + pos = simple_strtoul(priv->csi, &end, 10); - priv->y = pos ? pos - 1 : 0; + priv->y = (pos && pos <= priv->rows + 1) ? pos - 1 : 0; + pos = simple_strtoul(end + 1, NULL, 10); - priv->x = pos ? pos - 1 : 0; + priv->x = (pos && pos <= priv->cols + 1) ? pos - 1 : 0; + video_invertchar(priv, priv->x, priv->y); case 'K': pos = simple_strtoul(priv->csi, &end, 10); -- 2.11.0 _______________________________________________ barebox mailing list barebox@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/barebox
