From a167e9f751b06c07f952324476fb055bfaaed03b Mon Sep 17 00:00:00 2001
From: Damjan Adamic <projectkk2glider@gmail.com>
Date: Tue, 15 Aug 2017 15:57:29 +0200
Subject: [PATCH] Fixes #5055: infinite loop in lcdDrawFilledRect() when `h`
 parameter is bigger than 127. Similar fixes in other places. (#5058)

---
 radio/src/gui/128x64/lcd.cpp | 13 ++++++++-----
 radio/src/gui/212x64/lcd.cpp | 11 +++++++----
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/radio/src/gui/128x64/lcd.cpp b/radio/src/gui/128x64/lcd.cpp
index be35b6e6d..e9f46fc8f 100644
--- a/radio/src/gui/128x64/lcd.cpp
+++ b/radio/src/gui/128x64/lcd.cpp
@@ -750,12 +750,12 @@ void lcdDrawRect(coord_t x, coord_t y, coord_t w, coord_t h, uint8_t pat, LcdFla
 void lcdDrawFilledRect(coord_t x, scoord_t y, coord_t w, coord_t h, uint8_t pat, LcdFlags att)
 {
 #if defined(CPUM64)
-  for (scoord_t i=y; i<y+h; i++) {
+  for (scoord_t i=y; i<(scoord_t)(y+h); i++) {
     lcdDrawHorizontalLine(x, i, w, pat, att);
     pat = (pat >> 1) + ((pat & 1) << 7);
   }
 #else
-  for (scoord_t i=y; i<y+h; i++) {
+  for (scoord_t i=y; i<(scoord_t)(y+h); i++) {    // cast to scoord_t needed otherwise (y+h) is promoted to int (see #5055)
     if ((att&ROUND) && (i==y || i==y+h-1))
       lcdDrawHorizontalLine(x+1, i, w-2, pat, att);
     else
@@ -1516,7 +1516,7 @@ void NAME(coord_t x, coord_t y, TYPE img, uint8_t idx, LcdFlags att)          \
   q += idx*w*hb;                                                              \
   for (uint8_t yb = 0; yb < hb; yb++) {                                       \
     uint8_t *p = &displayBuf[(y / 8 + yb) * LCD_W + x];                       \
-    for (coord_t i=0; i<w; i++){                                              \
+    for (uint8_t i=0; i<w; i++){                                              \
       uint8_t b = READ_BYTE(q);                                               \
       q++;                                                                    \
       ASSERT_IN_DISPLAY(p);                                                   \
@@ -1554,9 +1554,12 @@ void lcdDrawPoint(coord_t x, coord_t y, LcdFlags att)
   }
 }
 
-void lcdInvertLine(int8_t y)
+void lcdInvertLine(int8_t line)
 {
-  uint8_t *p  = &displayBuf[y * LCD_W];
+  if (line < 0) return;
+  if (line >= LCD_LINES) return;
+
+  uint8_t *p  = &displayBuf[line * LCD_W];
   for (coord_t x=0; x<LCD_W; x++) {
     ASSERT_IN_DISPLAY(p);
     *p++ ^= 0xff;
diff --git a/radio/src/gui/212x64/lcd.cpp b/radio/src/gui/212x64/lcd.cpp
index 2711ca934..9601ff2ab 100644
--- a/radio/src/gui/212x64/lcd.cpp
+++ b/radio/src/gui/212x64/lcd.cpp
@@ -87,7 +87,7 @@ void lcdPutPattern(coord_t x, coord_t y, const uint8_t * pattern, uint8_t width,
   uint8_t lines = (height+7)/8;
   assert(lines <= 5);
 
-  for (int8_t i=0; i<width+2; i++) {
+  for (int8_t i=0; i<(int8_t)(width+2); i++) {
     if (x<LCD_W) {
       uint8_t b[5] = { 0 };
       if (i==0) {
@@ -120,7 +120,7 @@ void lcdPutPattern(coord_t x, coord_t y, const uint8_t * pattern, uint8_t width,
         }
       }
 
-      for (int8_t j=-1; j<=height; j++) {
+      for (int8_t j=-1; j<=(int8_t)(height); j++) {
         bool plot;
         if (j < 0 || ((j == height) && !(FONTSIZE(flags) == SMLSIZE))) {
           plot = false;
@@ -484,7 +484,7 @@ void lcdDrawRect(coord_t x, coord_t y, coord_t w, coord_t h, uint8_t pat, LcdFla
 #if !defined(BOOT)
 void lcdDrawFilledRect(coord_t x, scoord_t y, coord_t w, coord_t h, uint8_t pat, LcdFlags att)
 {
-  for (scoord_t i=y; i<y+h; i++) {
+  for (scoord_t i=y; i<(scoord_t)(y+h); i++) {
     if ((att&ROUND) && (i==y || i==y+h-1))
       lcdDrawHorizontalLine(x+1, i, w-2, pat, att);
     else
@@ -873,6 +873,9 @@ void lcdDrawVerticalLine(coord_t x, scoord_t y, scoord_t h, uint8_t pat, LcdFlag
 
 void lcdInvertLine(int8_t line)
 {
+  if (line < 0) return;
+  if (line >= LCD_LINES) return;
+
   uint8_t *p  = &displayBuf[line * 4 * LCD_W];
   for (coord_t x=0; x<LCD_W*4; x++) {
     ASSERT_IN_DISPLAY(p);
@@ -889,7 +892,7 @@ void lcdDraw1bitBitmap(coord_t x, coord_t y, const pm_uchar * img, uint8_t idx,
   bool    inv  = (att & INVERS) ? true : (att & BLINK ? BLINK_ON_PHASE : false);
   q += idx*w*hb;
   for (uint8_t yb = 0; yb < hb; yb++) {
-    for (coord_t i=0; i<w; i++) {
+    for (uint8_t i=0; i<w; i++) {
       uint8_t b = pgm_read_byte(q++);
       uint8_t val = inv ? ~b : b;
       for (int k=0; k<8; k++) {