extmod/modframebuf.c: pixel index arithmetic overflows on 16-bit int targets (out-of-bounds writes)

Open Beginner friendly
#19,431 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
c
Domain
embedded-iot

Research direction

Start in extmod/modframebuf.c and inspect the fourteen pixel index expressions shaped like x + y * fb->stride. Reproduce the issue on a 16-bit-int target or emulator, then verify all affected expressions use the intended size-safe arithmetic and no out-of-bounds writes occur for the 256×192 framebuffer. The proposed patches/0001-compiler-workarounds.patch and its DECISIONS.md entry provide additional context.

Written by the indexing model from the issue text.

Description

bug extmod

The pixel index expressions in extmod/modframebuf.c — fourteen of them, shaped like x + y * fb->stride — are computed in (16-bit-promotable) integer arithmetic. With 16-bit int, a 256-wide buffer overflows the index from y ≥ 128 and reads/writes land out of bounds. On our port this corrupted the heap every time text was drawn on the lower half of a 256×192 framebuffer.

Environment: MicroPython v1.28.0, custom 65816 (SNES) port, Calypsi toolchain (16-bit int). Any 16-bit-int build is affected. Our fix (cast the operands to size_t in all 14 index expressions) is in patches/0001-compiler-workarounds.patch: https://github.com/FabianKuebler/micropython-snes (DECISIONS.md, "modframebuf 16-bit overflow" entry).


Analysis and drafting done with AI assistance; every finding verified on target/emulator.

Dominant language
C
Stars
22.1k
Forks
9k
Avg merge
6d 4h
Merged PRs (30d)
16

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from micropython/micropython

All issues in micropython/micropython

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.