Re: [PATCH v3 0/2] video: bmp: fix out-of-bounds write in the RLE8 decoder

On Wed, 29 Jul 2026 18:47:00 +0200, Shahriyar Jalayeri wrote:

> This fixes an out-of-bounds write in the RLE8 BMP decoder and adds a
> regression test.
> 
> video_display_rle8_bitmap() lets the framebuffer cursor drift below the
> start of the framebuffer via repeated End-Of-Line escapes, so a crafted
> image displayed from the splash-screen or PXE-menu path (loaded from
> removable media or over TFTP) writes before the framebuffer. Patch 1
> bounds each run and rejects such an image with -EINVAL; patch 2 adds a DM
> test for it.
> 
> [...]

Applied to u-boot/next, thanks!

[1/2] video: bmp: bound RLE8 decode writes to the framebuffer
      commit: 5201e83342d64c2f438ea35158575f28225e752e
[2/2] test: video: add regression test for RLE8 bmp overflow
      commit: 7b98576726e6c2779bdf029e2c42f75e7705dee9
-- 
Tom