From: Ville Syrjälä ville.syrjala@linux.intel.com
Make sure we don't access beyond the extension block when parsing CEA detailed timing descriptors.
Signed-off-by: Ville Syrjälä ville.syrjala@linux.intel.com --- drivers/gpu/drm/drm_edid.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 7ee7be1..0194d4a 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -516,6 +516,9 @@ cea_for_each_detailed_block(u8 *ext, detailed_cb *cb, void *closure) u8 d = ext[0x02]; u8 *det_base = ext + d;
+ if (d > 127) + return; + n = (127 - d) / 18; for (i = 0; i < n; i++) cb((struct detailed_timing *)(det_base + 18 * i), closure);
On Thu, Mar 1, 2012 at 7:01 AM, ville.syrjala@linux.intel.com wrote:
From: Ville Syrjälä ville.syrjala@linux.intel.com
Make sure we don't access beyond the extension block when parsing CEA detailed timing descriptors.
Signed-off-by: Ville Syrjälä ville.syrjala@linux.intel.com
Reviewed-by: Alex Deucher alexander.deucher@amd.com
drivers/gpu/drm/drm_edid.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 7ee7be1..0194d4a 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -516,6 +516,9 @@ cea_for_each_detailed_block(u8 *ext, detailed_cb *cb, void *closure) u8 d = ext[0x02]; u8 *det_base = ext + d;
- if (d > 127)
- return;
n = (127 - d) / 18; for (i = 0; i < n; i++) cb((struct detailed_timing *)(det_base + 18 * i), closure); -- 1.7.3.4
dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel
dri-devel@lists.freedesktop.org
-
Alex Deucher -
ville.syrjala＠linux.intel.com