extmod/modframebuf.c: pixel index arithmetic overflows on 16-bit int targets (out-of-bounds writes)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- c
- Domain
- embedded-iot
Research direction
Start in extmod/modframebuf.c and inspect the fourteen pixel index expressions shaped like x + y * fb->stride. Reproduce the issue on a 16-bit-int target or emulator, then verify all affected expressions use the intended size-safe arithmetic and no out-of-bounds writes occur for the 256×192 framebuffer. The proposed patches/0001-compiler-workarounds.patch and its DECISIONS.md entry provide additional context.
Written by the indexing model from the issue text.
Description
The pixel index expressions in extmod/modframebuf.c — fourteen of them, shaped like x + y * fb->stride — are computed in (16-bit-promotable) integer arithmetic. With 16-bit int, a 256-wide buffer overflows the index from y ≥ 128 and reads/writes land out of bounds. On our port this corrupted the heap every time text was drawn on the lower half of a 256×192 framebuffer.
Environment: MicroPython v1.28.0, custom 65816 (SNES) port, Calypsi toolchain (16-bit int). Any 16-bit-int build is affected. Our fix (cast the operands to size_t in all 14 index expressions) is in patches/0001-compiler-workarounds.patch: https://github.com/FabianKuebler/micropython-snes (DECISIONS.md, "modframebuf 16-bit overflow" entry).
Analysis and drafting done with AI assistance; every finding verified on target/emulator.
- Dominant language
- C
- Stars
- 22.1k
- Forks
- 9k
- Avg merge
- 6d 4h
- Merged PRs (30d)
- 16
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from micropython/micropython
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
micropython/micropython#19704 ·
-
bug port-stm32
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
micropython/micropython#19668 · 1 comment ·
-
bug port-esp32
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
micropython/micropython#19667 · 1 comment ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
micropython/micropython#19509 · 12 comments ·
-
bug port-esp32
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
micropython/micropython#19456 ·
All issues in micropython/micropython
Similar issues
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
hapostgres/pg_auto_failover#1190 ·
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
spack/spack-packages#6586 ·