- biosfn_scroll(): check variable 'i' for underflowing when scrolling downwards

  to avoid screen corruption

1 files changed, 3 insertions, 0 deletions

diff --git a/vgabios.c b/vgabios.c
index 7190c0e..a1fb756 100644
--- a/vgabios.c
+++ b/vgabios.c
@@ -1288,6 +1288,7 @@ Bit8u nblines;Bit8u attr;Bit8u rul;Bit8u cul;Bit8u rlr;Bit8u clr;Bit8u page;Bit8
           memsetw(vga_modes[line].sstart,address+(i*nbcols+cul)*2,(Bit16u)attr*0x100+' ',cols);
          else
           memcpyw(vga_modes[line].sstart,address+(i*nbcols+cul)*2,vga_modes[line].sstart,((i-nblines)*nbcols+cul)*2,cols);
+         if (i>rlr) break;
         }
       }
     }
@@ -1324,6 +1325,7 @@ Bit8u nblines;Bit8u attr;Bit8u rul;Bit8u cul;Bit8u rlr;Bit8u clr;Bit8u page;Bit8
               vgamem_fill_pl4(cul,i,cols,nbcols,cheight,attr);
              else
               vgamem_copy_pl4(cul,i,i-nblines,cols,nbcols,cheight);
+             if (i>rlr) break;
             }
           }
         }
@@ -1359,6 +1361,7 @@ Bit8u nblines;Bit8u attr;Bit8u rul;Bit8u cul;Bit8u rlr;Bit8u clr;Bit8u page;Bit8
               vgamem_fill_cga(cul,i,cols,nbcols,cheight,attr);
              else
               vgamem_copy_cga(cul,i,i-nblines,cols,nbcols,cheight);
+             if (i>rlr) break;
             }
           }
         }