[xen stable-4.20] video/vesa: harden font height parsing

[patchbot@xxxxxxx]

commit 16489085bd8052cbae02b5fd18437847bd33f532
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Apr 20 12:36:32 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Apr 20 12:36:32 2026 +0200

    video/vesa: harden font height parsing
    
    We should not prematurely increment the pointer, to avoid inadvertently
    skipping a NUL terminator.
    
    Fixes: 6d9199bd0f22 ("x86-64: enable hypervisor output on VESA frame 
buffer")
    Reported-by: Kamil Frankowicz <kamil.frankowicz@xxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 3bcce461a33a8c0c0721543638ce375178d90006
    master date: 2026-04-07 13:54:37 +0200
---
 xen/drivers/video/vesa.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/drivers/video/vesa.c b/xen/drivers/video/vesa.c
index 70feca21ac..f6c6afd40c 100644
--- a/xen/drivers/video/vesa.c
+++ b/xen/drivers/video/vesa.c
@@ -31,8 +31,8 @@ static unsigned int __initdata vram_remap;
 static unsigned int __initdata font_height;
 static int __init cf_check parse_font_height(const char *s)
 {
-    if ( simple_strtoul(s, &s, 10) == 8 && (*s++ == 'x') )
-        font_height = simple_strtoul(s, &s, 10);
+    if ( simple_strtoul(s, &s, 10) == 8 && (*s == 'x') )
+        font_height = simple_strtoul(s + 1, &s, 10);
     if ( *s != '\0' )
         font_height = 0;
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20