Current implementation of Blt() in EFI_GRAPHICS_OUTPUT_PROTOCOL assumes the memory buffer stride (number of bytes in a row) always matches the rectangle Width, ignoring non-zero Delta.
Signed-off-by: Ivan Gorinov ivan.gorinov@intel.com --- lib/efi_loader/efi_gop.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/lib/efi_loader/efi_gop.c b/lib/efi_loader/efi_gop.c index 3caddd5..362065b 100644 --- a/lib/efi_loader/efi_gop.c +++ b/lib/efi_loader/efi_gop.c @@ -64,6 +64,7 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, void *buffer, { struct efi_gop_obj *gopobj = container_of(this, struct efi_gop_obj, ops); int i, j, line_len16, line_len32; + int buffer_stride; void *fb;
EFI_ENTRY("%p, %p, %u, %zu, %zu, %zu, %zu, %zu, %zu, %zu", this, @@ -72,6 +73,11 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, void *buffer, if (operation != EFI_BLT_BUFFER_TO_VIDEO) return EFI_EXIT(EFI_INVALID_PARAMETER);
+ if (delta == 0) + buffer_stride = width * sizeof(u32); + else + buffer_stride = delta; + fb = gopobj->fb; line_len16 = gopobj->info.width * sizeof(u16); line_len32 = gopobj->info.width * sizeof(u32); @@ -87,7 +93,7 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, void *buffer, for (i = 0; i < height; i++) { u32 *dest = fb + ((i + dy) * line_len32) + (dx * sizeof(u32)); - u32 *src = buffer + ((i + sy) * line_len32) + + u32 *src = buffer + ((i + sy) * buffer_stride) + (sx * sizeof(u32));
/* Same color format, just memcpy */ @@ -102,7 +108,7 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, void *buffer, for (i = 0; i < height; i++) { u16 *dest = fb + ((i + dy) * line_len16) + (dx * sizeof(u16)); - u32 *src = buffer + ((i + sy) * line_len32) + + u32 *src = buffer + ((i + sy) * buffer_stride) + (sx * sizeof(u32));
/* Convert from rgb888 to rgb565 */