diff options
| author | Gustavo A. R. Silva <garsilva@embeddedor.com> | 2017-12-09 09:37:59 +0300 |
|---|---|---|
| committer | Zhenyu Wang <zhenyuw@linux.intel.com> | 2017-12-11 12:18:39 +0300 |
| commit | 461bd6227ede277138bf33c2156b6ebd1fba04c2 (patch) | |
| tree | 9b376b6f8f31057a37e47d5a47d76272dfe010ad /drivers/gpu/drm/i915/gvt/fb_decoder.c | |
| parent | eb3f05171c2e84f0114403df0fea942479fdaa3e (diff) | |
| download | linux-461bd6227ede277138bf33c2156b6ebd1fba04c2.tar.xz | |
drm/i915/gvt/fb_decoder: Fix out-of-bounds read
In case function skl_format_to_drm returns -EINVAL, fmt turns into a huge
number as fmt is of type u32, hence there is an out-of-bounds read when
using fmt as an index for array skl_pixel_formats at line 225:
plane->bpp = skl_pixel_formats[fmt].bpp;
Fix this by comparing the value returned by function skl_format_to_drm
against the size of array skl_pixel_formats, so in case it is greater than
or equal to the number of items contained in skl_pixel_formats, print an
error message and return -EINVAL.
Addresses-Coverity-ID: 1462495
Addresses-Coverity-ID: 1462502 ("Out-of-bounds read")
Fixes: 9f31d1063b43 ("drm/i915/gvt: Add framebuffer decoder support")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Diffstat (limited to 'drivers/gpu/drm/i915/gvt/fb_decoder.c')
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/fb_decoder.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915/gvt/fb_decoder.c index 72f42176f35c..6cc99543693f 100644 --- a/drivers/gpu/drm/i915/gvt/fb_decoder.c +++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c @@ -222,6 +222,12 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu, val & PLANE_CTL_ORDER_RGBX, val & PLANE_CTL_ALPHA_MASK, val & PLANE_CTL_YUV422_ORDER_MASK); + + if (fmt >= ARRAY_SIZE(skl_pixel_formats)) { + gvt_vgpu_err("Out-of-bounds pixel format index\n"); + return -EINVAL; + } + plane->bpp = skl_pixel_formats[fmt].bpp; plane->drm_format = skl_pixel_formats[fmt].drm_format; } else { |