dragon-nx32: fix box bounds checking for gfx calls

diff --git a/Kernel/platform-dragon-nx32/devtty.c b/Kernel/platform-dragon-nx32/devtty.c
index 21758bf..278d432 100644 (file)
--- a/Kernel/platform-dragon-nx32/devtty.c
+++ b/Kernel/platform-dragon-nx32/devtty.c
@@ -396,7 +396,7 @@ static int gfx_draw_op(uarg_t arg, char *ptr, uint8_t *buf)
     if (l < 8)
       return EINVAL;
     l -= 8;
-    if (p[0] > 191 || p[1] > 31 || p[2] > 191 || p[3] > 31 ||
+    if (p[0] > 191 || p[1] > 31 || p[2] > 192 || p[3] > 32 ||
       p[0] + p[2] > 192 || p[1] + p[3] > 32 ||
       (p[2] * p[3]) > l)
       return -EFAULT;