From d45a0d9327780b0b670c1562b36e5593f1b4678c Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Mon, 6 Jul 2026 09:15:40 +0800 Subject: [PATCH] bsp: nxp: Bound VGLite buffer reader access Check the buffer limits before reading ptr[i] in bufferred_fgets(). Also guard CR/LF skipping against the available input bytes so reading a full buffer does not inspect one byte past the source. Generated-by: OpenAI Codex Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- .../imx/imxrt/libraries/drivers/vglite/font/buf_reader.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c b/bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c index 7fa832c6f5e..d9d48ee8263 100644 --- a/bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c +++ b/bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c @@ -190,7 +190,7 @@ char *bufferred_fgets(char* buff, int len, bufferred_reader_t *fd) return NULL; ptr = fd->data_buf + fd->index; - for(i=0; ptr[i] != '\0' && i < len; i++) + for(i=0; i < len && ptr[i] != '\0'; i++) { if ( ptr[i] == '\n' ) break; @@ -201,9 +201,9 @@ char *bufferred_fgets(char* buff, int len, bufferred_reader_t *fd) buff[i] = '\0'; j = i; /* skip trailing newline from file buffer */ - if ( ptr[i] == '\r' ) + if ( i < valid_bytes && ptr[i] == '\r' ) i++; - if ( ptr[i] == '\n' ) + if ( i < valid_bytes && ptr[i] == '\n' ) i++; fd->index += i;