leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm: edid: Add bounds checking to HDMI VSDB parsing

Browse Source 
The length of HDMI VSDB must be at least 5 bytes. Other than the minimum,
nothing else about the length is specified. Check the length before
accessing any additional field beyond the minimum length.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
Ville Syrjälä
2012-08-16 14:55:05 +00:00
committed by Dave Airlie
parent 9e50b9d55e
commit 8504072a2a
1 changed files with 21 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
drivers/gpu/drm/drm_edid.c
View File

@@ -1576,19 +1576,28 @@ add_cea_modes(struct drm_connector *connector, struct edid *edid)
} }
static void static void
parse_hdmi_vsdb(struct drm_connector *connector, uint8_t *db) parse_hdmi_vsdb(struct drm_connector *connector, const u8 *db)
{ {
connector->eld[5] |= (db[6] >> 7) << 1; /* Supports_AI */ u8 len = cea_db_payload_len(db);
connector->dvi_dual = db[6] & 1; if (len >= 6) {
connector->max_tmds_clock = db[7] * 5; connector->eld[5] |= (db[6] >> 7) << 1; /* Supports_AI */
connector->dvi_dual = db[6] & 1;
connector->latency_present[0] = db[8] >> 7; }
connector->latency_present[1] = (db[8] >> 6) & 1; if (len >= 7)
connector->video_latency[0] = db[9]; connector->max_tmds_clock = db[7] * 5;
connector->audio_latency[0] = db[10]; if (len >= 8) {
connector->video_latency[1] = db[11]; connector->latency_present[0] = db[8] >> 7;
connector->audio_latency[1] = db[12]; connector->latency_present[1] = (db[8] >> 6) & 1;
}
if (len >= 9)
connector->video_latency[0] = db[9];
if (len >= 10)
connector->audio_latency[0] = db[10];
if (len >= 11)
connector->video_latency[1] = db[11];
if (len >= 12)
connector->audio_latency[1] = db[12];
DRM_LOG_KMS("HDMI: DVI dual %d, " DRM_LOG_KMS("HDMI: DVI dual %d, "
"max TMDS clock %d, " "max TMDS clock %d, "
@@ -1684,7 +1693,7 @@ void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid)
break; break;
case VENDOR_BLOCK: case VENDOR_BLOCK:
/* HDMI Vendor-Specific Data Block */ /* HDMI Vendor-Specific Data Block */
if (db[1] == 0x03 && db[2] == 0x0c && db[3] == 0) if (dbl >= 5 && db[1] == 0x03 && db[2] == 0x0c && db[3] == 0)
parse_hdmi_vsdb(connector, db); parse_hdmi_vsdb(connector, db);
break; break;
default: default: