[PATCH v3 0/2] video: bmp: fix out-of-bounds write in the RLE8 decoder

This fixes an out-of-bounds write in the RLE8 BMP decoder and adds a
regression test.

video_display_rle8_bitmap() lets the framebuffer cursor drift below the
start of the framebuffer via repeated End-Of-Line escapes, so a crafted
image displayed from the splash-screen or PXE-menu path (loaded from
removable media or over TFTP) writes before the framebuffer. Patch 1
bounds each run and rejects such an image with -EINVAL; patch 2 adds a DM
test for it.

Based on v2026.07 (fdfe2ec48d5c).

Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Changes in v3:
- Propagate the return code from video_display_rle8_bitmap() instead of
  flattening it to -EINVAL (Simon Glass)

Changes in v2:
- Use my real name in the From and Signed-off-by

---
Shahriyar Jalayeri (2):
      video: bmp: bound RLE8 decode writes to the framebuffer
      test: video: add regression test for RLE8 bmp overflow

 drivers/video/video_bmp.c | 28 +++++++++++++++++++-------
 test/dm/video.c           | 50 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 7 deletions(-)
---
base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1
change-id: 20260722-video-oob-fix-69c4a7298519

Best regards,
--  
Shahriyar Jalayeri <[email protected]>