[PATCH] drm: edid: Add bounds checking to CEA 18 byte descriptor parsing

[Alex Deucher]

On Thu, Mar 1, 2012 at 7:01 AM,  <ville.syrjala at linux.intel.com> wrote:
> From: Ville Syrjälä <ville.syrjala at linux.intel.com>
>
> Make sure we don't access beyond the extension block when parsing CEA
> detailed timing descriptors.
>
> Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>

Reviewed-by: Alex Deucher <alexander.deucher at amd.com>

> ---
>  drivers/gpu/drm/drm_edid.c |    3 +++
>  1 files changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
> index 7ee7be1..0194d4a 100644
> --- a/drivers/gpu/drm/drm_edid.c
> +++ b/drivers/gpu/drm/drm_edid.c
> @@ -516,6 +516,9 @@ cea_for_each_detailed_block(u8 *ext, detailed_cb *cb, void *closure)
>        u8 d = ext[0x02];
>        u8 *det_base = ext + d;
>
> +       if (d > 127)
> +               return;
> +
>        n = (127 - d) / 18;
>        for (i = 0; i < n; i++)
>                cb((struct detailed_timing *)(det_base + 18 * i), closure);
> --
> 1.7.3.4
>
> _______________________________________________
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel