From d2e3f475ffa184787de033ddff80fda8506de76b Mon Sep 17 00:00:00 2001
From: kub <derkub@gmail.com>
Date: Sat, 16 Oct 2021 10:05:04 +0200
Subject: [PATCH] core, fix rendering copy buffer overlap reported from asan

---
 pico/draw.c     |  9 ++++++---
 pico/draw_arm.S | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/pico/draw.c b/pico/draw.c
index 2b349228..236e347e 100644
--- a/pico/draw.c
+++ b/pico/draw.c
@@ -132,8 +132,12 @@ void blockcpy_or(void *dst, void *src, size_t n, int pat);
 void blockcpy_or(void *dst, void *src, size_t n, int pat)
 {
   unsigned char *pd = dst, *ps = src;
-  for (; n; n--)
-    *pd++ = (unsigned char) (*ps++ | pat);
+  if (dst > src) {
+    for (pd += n, ps += n; n; n--)
+      *--pd = (unsigned char) (*--ps | pat);
+  } else
+    for (; n; n--)
+      *pd++ = (unsigned char) (*ps++ | pat);
 }
 #define blockcpy memmove
 #endif
@@ -2019,7 +2023,6 @@ void PicoDrawSetOutFormat(pdso_t which, int use_32x_line_mode)
   {
     case PDF_8BIT:
       FinalizeLine = FinalizeLine8bit;
-      PicoDrawSetInternalBuf(Pico.est.Draw2FB, 328);
       break;
 
     case PDF_RGB555:
diff --git a/pico/draw_arm.S b/pico/draw_arm.S
index 6a3641bd..a9915635 100644
--- a/pico/draw_arm.S
+++ b/pico/draw_arm.S
@@ -2205,6 +2205,9 @@ FinalizeLine555:
 
 blockcpy:
     stmfd   sp!, {r4,r5}
+    cmp     r0, r1
+    bhs     blockcpyhi
+
     mov     r2, r2, lsr #4
 blockcpy_loop:
     ldmia   r1!, {r3-r5,r12}
@@ -2214,6 +2217,18 @@ blockcpy_loop:
     ldmfd   sp!, {r4,r5}
     bx      lr
 
+blockcpyhi:
+    add     r0, r0, r2
+    add     r1, r1, r2
+    mov     r2, r2, lsr #4
+blockcpyhi_loop:
+    ldmdb   r1!, {r3-r5,r12}
+    subs    r2, r2, #1
+    stmdb   r0!, {r3-r5,r12}
+    bne     blockcpyhi_loop
+    ldmfd   sp!, {r4,r5}
+    bx      lr
+
 
 .global blockcpy_or @ void *dst, void *src, size_t n, int pat
 
@@ -2221,6 +2236,9 @@ blockcpy_or:
     stmfd   sp!, {r4-r6}
     orr     r3, r3, r3, lsl #8
     orr     r3, r3, r3, lsl #16
+    cmp     r0, r1
+    bhs     blockcpyhi_or
+
     mov     r2, r2, lsr #4
 blockcpy_loop_or:
     ldmia   r1!, {r4-r6,r12}
@@ -2234,4 +2252,20 @@ blockcpy_loop_or:
     ldmfd   sp!, {r4-r6}
     bx      lr
 
+blockcpyhi_or:
+    add     r0, r0, r2
+    add     r1, r1, r2
+    mov     r2, r2, lsr #4
+blockcpyhi_loop_or:
+    ldmdb   r1!, {r4-r6,r12}
+    subs    r2, r2, #1
+    orr     r4, r4, r3
+    orr     r5, r5, r3
+    orr     r6, r6, r3
+    orr     r12,r12,r3
+    stmdb   r0!, {r4-r6,r12}
+    bne     blockcpyhi_loop_or
+    ldmfd   sp!, {r4-r6}
+    bx      lr
+
 @ vim:filetype=armasm
-- 
2.39.2