On 03/14/2018 04:31 AM, Ivan Gorinov wrote:
Current implementation of Blt() in EFI_GRAPHICS_OUTPUT_PROTOCOL assumes the memory buffer stride (number of bytes in a row) always matches the rectangle Width, ignoring non-zero Delta.
Signed-off-by: Ivan Gorinov ivan.gorinov@intel.com
lib/efi_loader/efi_gop.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/lib/efi_loader/efi_gop.c b/lib/efi_loader/efi_gop.c index 3caddd5..362065b 100644 --- a/lib/efi_loader/efi_gop.c +++ b/lib/efi_loader/efi_gop.c @@ -64,6 +64,7 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, void *buffer, { struct efi_gop_obj *gopobj = container_of(this, struct efi_gop_obj, ops); int i, j, line_len16, line_len32;
int buffer_stride; void *fb;
EFI_ENTRY("%p, %p, %u, %zu, %zu, %zu, %zu, %zu, %zu, %zu", this,
@@ -72,6 +73,11 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, void *buffer, if (operation != EFI_BLT_BUFFER_TO_VIDEO) return EFI_EXIT(EFI_INVALID_PARAMETER);
- if (delta == 0)
buffer_stride = width * sizeof(u32);- else
buffer_stride = delta;- fb = gopobj->fb; line_len16 = gopobj->info.width * sizeof(u16); line_len32 = gopobj->info.width * sizeof(u32);
@@ -87,7 +93,7 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, void *buffer, for (i = 0; i < height; i++) { u32 *dest = fb + ((i + dy) * line_len32) + (dx * sizeof(u32));
u32 *src = buffer + ((i + sy) * line_len32) +
u32 *src = buffer + ((i + sy) * buffer_stride) + (sx * sizeof(u32)); /* Same color format, just memcpy */@@ -102,7 +108,7 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, void *buffer, for (i = 0; i < height; i++) { u16 *dest = fb + ((i + dy) * line_len16) + (dx * sizeof(u16));
u32 *src = buffer + ((i + sy) * line_len32) +
u32 *src = buffer + ((i + sy) * buffer_stride) +
If delta cannot be divided by 4 a misaligned access error will occur on arm64.
Best regards
Heinrich
(sx * sizeof(u32)); /* Convert from rgb888 to rgb565 */