From: Ville Syrjälä <ville.syrj...@linux.intel.com>
Make sure we don't access beyond the extension block when parsing CEA
detailed timing descriptors.
Signed-off-by: Ville Syrjälä <ville.syrj...@linux.intel.com>
Reviewed-by: Alex Deucher <alexander.deuc...@amd.com>
---
drivers/gpu/drm/drm_edid.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5873e48..a346b04 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -551,6 +551,9 @@ cea_for_each_detailed_block(u8 *ext, detailed_cb *cb, void
*closure)
u8 d = ext[0x02];
u8 *det_base = ext + d;
+ if (d > 127)
+ return;
+
n = (127 - d) / 18;
for (i = 0; i < n; i++)
cb((struct detailed_timing *)(det_base + 18 * i), closure);
--
1.7.8.6
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
