From 8f3dcdcf9f2522bd438b8f02ace6c64c8761a28d Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Apr 2026 12:26:39 +0200 Subject: [PATCH] video/vesa: harden font height parsing We should not prematurely increment the pointer, to avoid inadvertently skipping a NUL terminator. Fixes: 6d9199bd0f22 ("x86-64: enable hypervisor output on VESA frame buffer") Reported-by: Kamil Frankowicz Signed-off-by: Jan Beulich Acked-by: Andrew Cooper master commit: 3bcce461a33a8c0c0721543638ce375178d90006 master date: 2026-04-07 13:54:37 +0200 --- xen/drivers/video/vesa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/drivers/video/vesa.c b/xen/drivers/video/vesa.c index 70feca21ac..f6c6afd40c 100644 --- a/xen/drivers/video/vesa.c +++ b/xen/drivers/video/vesa.c @@ -31,8 +31,8 @@ static unsigned int __initdata vram_remap; static unsigned int __initdata font_height; static int __init cf_check parse_font_height(const char *s) { - if ( simple_strtoul(s, &s, 10) == 8 && (*s++ == 'x') ) - font_height = simple_strtoul(s, &s, 10); + if ( simple_strtoul(s, &s, 10) == 8 && (*s == 'x') ) + font_height = simple_strtoul(s + 1, &s, 10); if ( *s != '\0' ) font_height = 0;