> -----Original Message-----
> From: dri-devel <dri-devel-boun...@lists.freedesktop.org> On Behalf Of Alex
> Deucher
> Sent: Tuesday, January 28, 2020 4:04 AM
> To: Ville Syrjala <ville.syrj...@linux.intel.com>
> Cc: Allen Chen <allen.c...@ite.com.tw>; Intel Graphics Development <intel-
> g...@lists.freedesktop.org>; Maling list - DRI developers <dri-
> de...@lists.freedesktop.org>
> Subject: Re: [PATCH 1/8] drm/edid: Check the number of detailed timing
> descriptors
> in the CEA ext block
>
> On Fri, Jan 24, 2020 at 3:03 PM Ville Syrjala <ville.syrj...@linux.intel.com>
> wrote:
> >
> > From: Ville Syrjälä <ville.syrj...@linux.intel.com>
> >
> > CEA-861 says :
> > "d = offset for the byte following the reserved data block.
> > If no data is provided in the reserved data block, then d=4.
> > If no DTDs are provided, then d=0."
> >
> > So let's not look for DTDs when d==0. In fact let's just make that
> > <4 since those values would just mean that he DTDs overlap the block
> > header. And let's also check that d isn't so big as to declare the
> > descriptors to live past the block end, although the code does already
> > survive that case as we'd just end up with a negative number of
> > descriptors and the loop would not do anything.
> >
> > Cc: Allen Chen <allen.c...@ite.com.tw>
> > Signed-off-by: Ville Syrjälä <ville.syrj...@linux.intel.com>
>
> Acked-by: Alex Deucher <alexander.deuc...@amd.com>
Looks good to me as well.
Reviewed-by: Uma Shankar <uma.shan...@intel.com>
> > ---
> > drivers/gpu/drm/drm_edid.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
> > index 99769d6c9f84..1b6e544cf5c7 100644
> > --- a/drivers/gpu/drm/drm_edid.c
> > +++ b/drivers/gpu/drm/drm_edid.c
> > @@ -2201,10 +2201,13 @@ typedef void detailed_cb(struct
> > detailed_timing *timing, void *closure); static void
> > cea_for_each_detailed_block(u8 *ext, detailed_cb *cb, void *closure)
> > {
> > - int i, n = 0;
> > + int i, n;
> > u8 d = ext[0x02];
> > u8 *det_base = ext + d;
> >
> > + if (d < 4 || d > 127)
> > + return;
> > +
> > n = (127 - d) / 18;
> > for (i = 0; i < n; i++)
> > cb((struct detailed_timing *)(det_base + 18 * i),
> > closure);
> > --
> > 2.24.1
> >
> > _______________________________________________
> > dri-devel mailing list
> > dri-devel@lists.freedesktop.org
> > https://lists.freedesktop.org/mailman/listinfo/dri-devel
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
