Fix another type of buffer overrun for segmented modes. The buffer index

was not taken modulo the window size in VGLClear().

Segmented modes also need a kernel fix to almost work.  The ioctl to set
the window origin is broken.

These bugs are rarely problems since non-VESA modes only need
segmentation to support multiple pages but libvgl doesn't support
multiple pages and treats these modes as non-segmented, and VESA modes
are usually mapped linearly except on old hardware so they really are
non-segmented.

1 files changed, 2 insertions, 1 deletions

diff --git a/lib/libvgl/simple.c b/lib/libvgl/simple.c
index 0605bbadd2ba..070dad590edf 100644
--- a/lib/libvgl/simple.c
+++ b/lib/libvgl/simple.c
@@ -535,7 +535,8 @@ VGLClear(VGLBitmap *object, u_long color)
       VGLSetSegment(offset);
       len = min(total - offset, VGLAdpInfo.va_window_size);
       for (i = 0; i < len; i += object->PixelBytes)
-	bcopy(b, object->Bitmap + offset + i, object->PixelBytes);
+	bcopy(object->Bitmap + (offset + i) % VGLAdpInfo.va_window_size, b,
+	      object->PixelBytes);
       offset += len;
     }
     break;