From faaa069d9970a92303f1b98bf3848720fe37e985 Mon Sep 17 00:00:00 2001
From: usualtree <1340399194@qq.com>
Date: Mon, 2 Nov 2026 12:30:30 +0800
Subject: [PATCH] [drivers][graphic] reject invalid framebuffer offsets

---
 components/drivers/graphic/graphic.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/components/drivers/graphic/graphic.c b/components/drivers/graphic/graphic.c
index 14de5a6cda12..9514afa7e4be 100644
--- a/components/drivers/graphic/graphic.c
+++ b/components/drivers/graphic/graphic.c
@@ -176,6 +176,11 @@ static rt_ssize_t _graphic_read(rt_device_t dev, rt_off_t pos, void *buffer, rt_
     struct rt_graphic_device *gdev = raw_to_graphic(dev);
     struct rt_graphic_plane *plane = gdev->primary_plane;
 
+    if (pos < 0 || (rt_size_t)pos >= plane->framebuffer_len)
+    {
+        return 0;
+    }
+
     res = rt_min_t(rt_ssize_t, plane->framebuffer_len - pos, size);
 
     if (res > 0)
@@ -196,6 +201,11 @@ static rt_ssize_t _graphic_write(rt_device_t dev, rt_off_t pos, const void *buff
     struct rt_graphic_device *gdev = raw_to_graphic(dev);
     struct rt_graphic_plane *plane = gdev->primary_plane;
 
+    if (pos < 0 || (rt_size_t)pos >= plane->framebuffer_len)
+    {
+        return 0;
+    }
+
     res = rt_min_t(rt_ssize_t, plane->framebuffer_len - pos, size);
 
     if (res > 0)