Added checks to avoid writing past the end of the buffer in fbBltOne

(cherry picked from commit e5f54f122b)

fb/fbbltone.c

@@ -57,6 +57,13 @@
 	bits = (src < srcEnd ? READ(src++) : 0); \
 }
 
+#define CHECK_BOUNDS(pointer, limit) \
+  if (dst > dstEnd) { \
+    ErrorF("WARNING: fbbltone tried to write over end of buffer (dst=%p dstEnd=%p)\n", \
+	   dst, dstEnd); \
+    return; \
+  }
+    
 #ifndef FBNOPIXADDR
     
 #define LaneCases1(n,a)	    case n: (void)FbLaneCase(n,a); break
@@ -148,7 +155,7 @@ fbBltOne (FbStip    *src,
 	  FbBits    bgxor)
 {
     const FbBits    *fbBits;
-    FbBits	    *srcEnd;
+    FbBits	    *srcEnd, *dstEnd;
     int		    pixelsPerDst;		/* dst pixels per FbBits */
     int		    unitsPerSrc;		/* src patterns per FbStip */
     int		    leftShift, rightShift;	/* align source with dest */
@@ -181,9 +188,10 @@ fbBltOne (FbStip    *src,
 #endif
 
     /*
-     * Do not read past the end of the buffer!
+     * Do not read or write past the end of the buffer!
      */
     srcEnd = src + height * srcStride;
+    dstEnd = dst + height * dstStride;
 
     /*
      * Number of destination units in FbBits == number of stipple pixels
@@ -296,6 +304,7 @@ fbBltOne (FbStip    *src,
 	     */
 	    if (startmask)
 	    {
+	      CHECK_BOUNDS(dst, dstEnd);
 #if FB_UNIT > 32
 		if (pixelsPerDst == 16)
 		    mask = FbStipple16Bits(FbLeftStipBits(bits,16));
@@ -336,6 +345,7 @@ fbBltOne (FbStip    *src,
 			else
 #endif
 			    mask = fbBits[FbLeftStipBits(bits,pixelsPerDst)];
+			CHECK_BOUNDS(dst, dstEnd);
 			WRITE(dst, FbOpaqueStipple (mask, fgxor, bgxor));
 			dst++;
 			bits = FbStipLeft(bits, pixelsPerDst);
@@ -346,6 +356,7 @@ fbBltOne (FbStip    *src,
 #ifndef FBNOPIXADDR
 		    if (fbLane)
 		    {
+		      CHECK_BOUNDS(dst, dstEnd);
 			while (bits && n)
 			{
 			    switch (fbLane[FbLeftStipBits(bits,pixelsPerDst)]) {
@@ -366,6 +377,7 @@ fbBltOne (FbStip    *src,
 			    if (left || !transparent)
 			    {
 				mask = fbBits[left];
+				CHECK_BOUNDS(dst, dstEnd);
 				WRITE(dst, FbStippleRRop (READ(dst), mask,
 						          fgand, fgxor, bgand, bgxor));
 			    }
@@ -586,7 +598,7 @@ fbBltOne24 (FbStip	*srcLine,
 	    FbBits	bgand,
 	    FbBits	bgxor)
 {
-    FbStip	*src, *srcEnd;
+    FbStip	*src, *srcEnd, *dstEnd;
     FbBits	leftMask, rightMask, mask;
     int		nlMiddle, nl;
     FbStip	stip, bits;
@@ -597,9 +609,10 @@ fbBltOne24 (FbStip	*srcLine,
     int		nDst;
     
     /*
-     * Do not read past the end of the buffer!
+     * Do not read or write past the end of the buffer!
      */
     srcEnd = srcLine + height * srcStride;
+    dstEnd = dst + height * dstStride;
 
     srcLine += srcX >> FB_STIP_SHIFT;
     dst += dstX >> FB_SHIFT;
@@ -629,6 +642,7 @@ fbBltOne24 (FbStip	*srcLine,
 	    if (leftMask)
 	    {
 		mask = fbStipple24Bits[rot >> 3][stip];
+		CHECK_BOUNDS(dst, dstEnd);
 		WRITE(dst, (READ(dst) & ~leftMask) |
 			    (FbOpaqueStipple (mask,
 					      FbRot24(fgxor, rot),
@@ -641,6 +655,7 @@ fbBltOne24 (FbStip	*srcLine,
 	    while (nl--)
 	    {
 		mask = fbStipple24Bits[rot>>3][stip];
+		CHECK_BOUNDS(dst, dstEnd);
 		WRITE(dst, FbOpaqueStipple (mask,
 					    FbRot24(fgxor, rot),
 					    FbRot24(bgxor, rot)));
@@ -650,6 +665,7 @@ fbBltOne24 (FbStip	*srcLine,
 	    if (rightMask)
 	    {
 		mask = fbStipple24Bits[rot >> 3][stip];
+		CHECK_BOUNDS(dst, dstEnd);
 		WRITE(dst, (READ(dst) & ~rightMask) |
 			    (FbOpaqueStipple (mask,
 					      FbRot24(fgxor, rot),
@@ -674,7 +690,8 @@ fbBltOne24 (FbStip	*srcLine,
 		if (stip)
 		{
 		    mask = fbStipple24Bits[rot >> 3][stip] & leftMask;
-		    WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor, rot) & mask));
+		    CHECK_BOUNDS(dst, dstEnd);
+			WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor, rot) & mask));
 		}
 		dst++;
 		fbNextStipBits (rot, stip);
@@ -685,6 +702,7 @@ fbBltOne24 (FbStip	*srcLine,
 		if (stip)
 		{
 		    mask = fbStipple24Bits[rot>>3][stip];
+			CHECK_BOUNDS(dst, dstEnd);
 		    WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor,rot) & mask));
 		}
 		dst++;
@@ -695,6 +713,7 @@ fbBltOne24 (FbStip	*srcLine,
 		if (stip)
 		{
 		    mask = fbStipple24Bits[rot >> 3][stip] & rightMask;
+			CHECK_BOUNDS(dst, dstEnd);
 		    WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor, rot) & mask));
 		}
 	    }
@@ -712,6 +731,7 @@ fbBltOne24 (FbStip	*srcLine,
 	    if (leftMask)
 	    {
 		mask = fbStipple24Bits[rot >> 3][stip];
+		CHECK_BOUNDS(dst, dstEnd);
 		WRITE(dst, FbStippleRRopMask (READ(dst), mask,
 					      FbRot24(fgand, rot),
 					      FbRot24(fgxor, rot),
@@ -725,6 +745,7 @@ fbBltOne24 (FbStip	*srcLine,
 	    while (nl--)
 	    {
 		mask = fbStipple24Bits[rot >> 3][stip];
+		CHECK_BOUNDS(dst, dstEnd);
 		WRITE(dst, FbStippleRRop (READ(dst), mask,
 					  FbRot24(fgand, rot),
 					  FbRot24(fgxor, rot),
@@ -736,6 +757,7 @@ fbBltOne24 (FbStip	*srcLine,
 	    if (rightMask)
 	    {
 		mask = fbStipple24Bits[rot >> 3][stip];
+		CHECK_BOUNDS(dst, dstEnd);
 		WRITE(dst, FbStippleRRopMask (READ(dst), mask,
 					      FbRot24(fgand, rot),
 					      FbRot24(fgxor, rot),