From ccdb7d05609797149b3445b211eaa16408e6aec1 Mon Sep 17 00:00:00 2001
From: tychovrahe <brunam@seznam.cz>
Date: Fri, 22 Sep 2023 16:49:12 +0200
Subject: [PATCH] fix(core): add boundaries check for icon rendering
 (framebuffer variant)

---
 core/embed/rust/src/ui/display/toif.rs        | 22 ++++++++++++++-----
 .../rust/src/ui/model_tt/bootloader/mod.rs    |  4 ++++
 core/embed/rust/src/ui/model_tt/layout.rs     |  1 +
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/core/embed/rust/src/ui/display/toif.rs b/core/embed/rust/src/ui/display/toif.rs
index f3a5f8388f..b39059e1c0 100644
--- a/core/embed/rust/src/ui/display/toif.rs
+++ b/core/embed/rust/src/ui/display/toif.rs
@@ -10,6 +10,7 @@ use crate::{
         geometry::{Alignment2D, Offset, Point, Rect},
     },
 };
+use core::cmp::max;
 
 #[cfg(feature = "dma2d")]
 use crate::{
@@ -74,8 +75,9 @@ pub fn render_toif(toif: &Toif, center: Point, fg_color: Color, bg_color: Color)
 pub fn render_toif(toif: &Toif, center: Point, fg_color: Color, bg_color: Color) {
     let r = Rect::from_center_and_size(center, toif.size());
     let area = r.translate(get_offset());
+    let clamped = area.clamp(constant::screen()).ensure_even_width();
 
-    set_window(area);
+    set_window(clamped);
 
     let mut b1 = BufferLine4bpp::get_cleared();
     let mut b2 = BufferLine4bpp::get_cleared();
@@ -85,13 +87,23 @@ pub fn render_toif(toif: &Toif, center: Point, fg_color: Color, bg_color: Color)
 
     dma2d_setup_4bpp(fg_color.into(), bg_color.into());
 
-    for y in area.y0..area.y1 {
+    let x_shift = max(0, clamped.x0 - area.x0);
+
+    for y in area.y0..clamped.y1 {
         let img_buffer_used = if y % 2 == 0 { &mut b1 } else { &mut b2 };
 
-        unwrap!(ctx.uncompress(&mut (&mut img_buffer_used.buffer)[0..(area.width() / 2) as usize]));
+        unwrap!(ctx.uncompress(&mut (&mut img_buffer_used.buffer)[..(area.width() / 2) as usize]));
 
-        dma2d_wait_for_transfer();
-        unsafe { dma2d_start(&img_buffer_used.buffer, area.width()) };
+        if y >= clamped.y0 {
+            dma2d_wait_for_transfer();
+            unsafe {
+                dma2d_start(
+                    &img_buffer_used.buffer
+                        [(x_shift / 2) as usize..((clamped.width() + x_shift) / 2) as usize],
+                    clamped.width(),
+                )
+            };
+        }
     }
 
     dma2d_wait_for_transfer();
diff --git a/core/embed/rust/src/ui/model_tt/bootloader/mod.rs b/core/embed/rust/src/ui/model_tt/bootloader/mod.rs
index 5e2cf0a9bf..78faabdeea 100644
--- a/core/embed/rust/src/ui/model_tt/bootloader/mod.rs
+++ b/core/embed/rust/src/ui/model_tt/bootloader/mod.rs
@@ -80,6 +80,7 @@ where
     fadeout();
     display::sync();
     frame.paint();
+    display::refresh();
     fadein();
 
     loop {
@@ -264,6 +265,8 @@ fn screen_progress(
     if initialize {
         fadein();
     }
+
+    display::refresh();
 }
 
 #[no_mangle]
@@ -340,6 +343,7 @@ extern "C" fn screen_boot_empty(fading: bool) {
     } else {
         display::set_backlight(BACKLIGHT_NORMAL);
     }
+    display::refresh();
 }
 
 #[no_mangle]
diff --git a/core/embed/rust/src/ui/model_tt/layout.rs b/core/embed/rust/src/ui/model_tt/layout.rs
index ca75443cc3..0b7ae9ca6d 100644
--- a/core/embed/rust/src/ui/model_tt/layout.rs
+++ b/core/embed/rust/src/ui/model_tt/layout.rs
@@ -1594,6 +1594,7 @@ extern "C" fn draw_welcome_screen() -> Obj {
     screen.place(constant::screen());
     display::sync();
     screen.paint();
+    display::refresh();
     display::set_backlight(theme::BACKLIGHT_NORMAL);
     Obj::const_none()
 }