From d5eed897fd0d0b9b7666bb33df0fd28d9919779b Mon Sep 17 00:00:00 2001
From: Damjan Adamic <projectkk2glider@gmail.com>
Date: Sat, 25 Oct 2014 19:35:52 +0200
Subject: [PATCH] Fixed buffer overflow in bmp_load()

---
 radio/src/lcd_taranis.cpp | 6 ++++++
 radio/src/tests/lcd.cpp   | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/radio/src/lcd_taranis.cpp b/radio/src/lcd_taranis.cpp
index db001d7c7..3693d7d76 100755
--- a/radio/src/lcd_taranis.cpp
+++ b/radio/src/lcd_taranis.cpp
@@ -149,6 +149,9 @@ void lcd_bmp(coord_t x, coord_t y, const uint8_t * img, uint8_t offset, uint8_t
     width = w;
   }
   if (x+width > LCD_W) {
+    if (x >= LCD_W ) {
+      return;
+    }
     width = LCD_W-x;
   }
   uint8_t rows = (*q++ + 1) / 2;
@@ -157,6 +160,9 @@ void lcd_bmp(coord_t x, coord_t y, const uint8_t * img, uint8_t offset, uint8_t
     q = img + 2 + row*w + offset;
     uint8_t *p = &displayBuf[(row + (y/2)) * LCD_W + x];
     for (coord_t i=0; i<width; i++) {
+      if ((p) >= DISPLAY_END) {
+        return;
+      }
       uint8_t b = *q++;
       if (y & 1) {
         *p = (*p & 0x0f) + ((b & 0x0f) << 4);
diff --git a/radio/src/tests/lcd.cpp b/radio/src/tests/lcd.cpp
index 350255415..d60597079 100644
--- a/radio/src/tests/lcd.cpp
+++ b/radio/src/tests/lcd.cpp
@@ -264,6 +264,8 @@ TEST(Lcd, BMPWrapping)
   bmpLoad(bitmap, "./tests/plane.bmp", 40, 40);
   lcd_bmp(200, 0, bitmap);
   lcd_bmp(200, 60, bitmap);
+  lcd_bmp(240, 60, bitmap);     // x too big
+  lcd_bmp(20, 200, bitmap);     // y too big
   EXPECT_TRUE(checkScreenshot("bmpwrapping"));
 }
 #endif