From f53df98f703a97b62ac3bdd955dbcffe5849b77a Mon Sep 17 00:00:00 2001
From: Damjan Adamic <projectkk2glider@gmail.com>
Date: Sat, 25 Oct 2014 19:58:59 +0200
Subject: [PATCH] Fixed buffer overflow in lcd_hlineStip()

---
 radio/src/lcd_taranis.cpp | 12 ++++++++++--
 radio/src/tests/lcd.cpp   | 27 +++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/radio/src/lcd_taranis.cpp b/radio/src/lcd_taranis.cpp
index 3693d7d76..3ca7ed00b 100755
--- a/radio/src/lcd_taranis.cpp
+++ b/radio/src/lcd_taranis.cpp
@@ -38,7 +38,10 @@
 
 void lcd_mask(uint8_t *p, uint8_t mask, LcdFlags att)
 {
-  ASSERT_IN_DISPLAY(p);
+  // ASSERT_IN_DISPLAY(p);
+  if ((p) >= DISPLAY_END) {
+    return;
+  }
 
   if (att&FILL_WHITE) {
     // TODO I could remove this, it's used for the top bar
@@ -71,7 +74,12 @@ void lcd_plot(coord_t x, coord_t y, LcdFlags att)
 void lcd_hlineStip(coord_t x, coord_t y, coord_t w, uint8_t pat, LcdFlags att)
 {
   if (y >= LCD_H) return;
-  if (x+w > LCD_W) { w = LCD_W - x; }
+  if (x+w > LCD_W) { 
+    if (x >= LCD_W ) {
+      return;
+    }
+    w = LCD_W - x; 
+  }
 
   uint8_t *p  = &displayBuf[ y / 2 * LCD_W + x ];
   uint8_t mask = PIXEL_GREY_MASK(y, att);
diff --git a/radio/src/tests/lcd.cpp b/radio/src/tests/lcd.cpp
index d60597079..884f2cf5a 100644
--- a/radio/src/tests/lcd.cpp
+++ b/radio/src/tests/lcd.cpp
@@ -269,3 +269,30 @@ TEST(Lcd, BMPWrapping)
   EXPECT_TRUE(checkScreenshot("bmpwrapping"));
 }
 #endif
+
+#if defined(PCBTARANIS)
+TEST(Lcd, lcd_hlineStip)
+{
+  lcd_clear();
+  lcd_hlineStip(0, 10, LCD_W, DOTTED);
+  lcd_hlineStip(0, 20, LCD_W, SOLID);
+  lcd_hlineStip(50, 30, LCD_W, 0xEE);    //too wide
+  lcd_hlineStip(50, LCD_H + 10, 20, SOLID);    //too low
+  lcd_hlineStip(250, 30, LCD_W, SOLID);    //x outside display
+  EXPECT_TRUE(checkScreenshot("lcd_hlineStip"));
+}
+#endif
+
+#if defined(PCBTARANIS)
+TEST(Lcd, lcd_vlineStip)
+{
+  lcd_clear();
+  lcd_vlineStip(10, 0, LCD_H, DOTTED);
+  lcd_vlineStip(20, 0, LCD_H, SOLID);
+  lcd_vlineStip(30, 30, LCD_H, 0xEE);    //too high
+  lcd_vlineStip(40, LCD_H + 10, 20, SOLID);    //too low
+  lcd_vlineStip(250, LCD_H + 10, LCD_H, SOLID);    //x outside display
+  EXPECT_TRUE(checkScreenshot("lcd_vlineStip"));
+}
+#endif
+