diff --git a/drivers/video/fbdev/core/fb_imageblit.h b/drivers/video/fbdev/core/fb_imageblit.h index 3b2bb4946505..9763b395ecf4 100644 --- a/drivers/video/fbdev/core/fb_imageblit.h +++ b/drivers/video/fbdev/core/fb_imageblit.h @@ -488,6 +488,17 @@ static inline void fb_imageblit(struct fb_info *p, const struct fb_image *image) fb_address_forward(&dst, image->dy * bits_per_line + image->dx * bpp); + if ((char *)dst.address < (char *)p->screen_base) { + return; + } + + unsigned long image_bits = (unsigned long)image->width * image->height * bpp; + unsigned long image_bytes = (image_bits + 7) / 8; + + if ((char *)dst.address + image_bytes > (char *)p->screen_base + p->screen_size) { + return; + } + if (image->depth == 1) fb_bitmap_imageblit(image, &dst, bits_per_line, palette, bpp, reverse); else