Hi,
On 03/28/2017 05:10 AM, Li Qiang wrote:
> In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
> 'req->mip_levels' array. This array can be assigned any value from
> the user space. As both the 'num_sizes' and the array is uint32_t,
> it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
> used as the loop count. This can lead an oob write. Add the check of
> 'req->mip_levels' to avoid this.
>
> Signed-off-by: Li Qiang <liqiang6-s@xxxxxx>
> ---
Thanks. Reviewed and queued for vmwgfx-fixes.
/Thomas
> drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> index b445ce9..ef8bf83 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> @@ -713,8 +713,11 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
> 128;
>
> num_sizes = 0;
> - for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
> + for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
> + if (req->mip_levels[i] > DRM_VMW_MAX_MIP_LEVELS)
> + return -EINVAL;
> num_sizes += req->mip_levels[i];
> + }
>
> if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
> DRM_VMW_MAX_MIP_LEVELS)
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
