On Thu, Mar 1, 2012 at 7:01 AM, <ville.syrjala@xxxxxxxxxxxxxxx> wrote: > From: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> > > Make sure we don't access beyond the extension block when parsing CEA > detailed timing descriptors. > > Signed-off-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> Reviewed-by: Alex Deucher <alexander.deucher@xxxxxxx> > --- > drivers/gpu/drm/drm_edid.c | 3 +++ > 1 files changed, 3 insertions(+), 0 deletions(-) > > diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c > index 7ee7be1..0194d4a 100644 > --- a/drivers/gpu/drm/drm_edid.c > +++ b/drivers/gpu/drm/drm_edid.c > @@ -516,6 +516,9 @@ cea_for_each_detailed_block(u8 *ext, detailed_cb *cb, void *closure) > u8 d = ext[0x02]; > u8 *det_base = ext + d; > > + if (d > 127) > + return; > + > n = (127 - d) / 18; > for (i = 0; i < n; i++) > cb((struct detailed_timing *)(det_base + 18 * i), closure); > -- > 1.7.3.4 > > _______________________________________________ > dri-devel mailing list > dri-devel@xxxxxxxxxxxxxxxxxxxxx > http://lists.freedesktop.org/mailman/listinfo/dri-devel _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/dri-devel
