[PATCH] conhost: Validate screen_buffer->width param in fill_output.

[Jacek Caban]

On 24.09.2020 04:19, Pengpeng Dong wrote:
> --- a/programs/conhost/conhost.c
> +++ b/programs/conhost/conhost.c
> @@ -2170,7 +2170,7 @@ static NTSTATUS fill_output( struct screen_buffer *screen_buffer, const struct c
>
> dest = screen_buffer->data + params->y * screen_buffer->width + params->x;
>
> -    if (params->y >= screen_buffer->height) return STATUS_SUCCESS;
> +    if (params->y >= screen_buffer->height && params->x >= screen_buffer->width) return STATUS_SUCCESS;

I think you meant to use || here. But even with that, it's not obviously 
correct to me. FillConsoleOutputCharacter wraps in the end of line, so 
it doesn't seem wrong to simply wrap passed x coord as well. It would 
need a test case.


Parameter checking may be improved a bit, through. I sent a patch.


Thanks,

Jacek