Some static checker stuff I'm working on complains:
drivers/video/fbdev/intelfb/intelfbdrv.c:1678 intelfb_cursor()
error: overflow detected. __memcpy() 'dinfo->cursor_src' is 64
bytes. limit = '1-128'
The math here is:
size = cursor->image.width / 8 * cursor->image.height;
Since the limit for ".width" and ".height" is 32x32 then
"32 / 4 * 32 = 128" but 128 is more than the sizeof(dinfo->cursor_src)
so it creates a buffer overflow warning.
I believe that Smatch is getting 32 as the max size from the tests in
con_font_set().
drivers/video/fbdev/intelfb/intelfbdrv.c
1632 if (cursor->set & FB_CUR_SETSIZE) {
1633 if (cursor->image.width > 64 || cursor->image.height > 64)
Here the limit is assumed to be 64 which would make the overflow worse
than the 32 limit mentioned earlier.
1634 return -ENXIO;
1635
1636 intelfbhw_cursor_reset(dinfo);
1637 }
1638
1639 if (cursor->set & FB_CUR_SETCMAP) {
1640 u32 fg, bg;
1641
1642 if (dinfo->depth != 8) {
1643 fg = dinfo->pseudo_palette[cursor->image.fg_color];
1644 bg = dinfo->pseudo_palette[cursor->image.bg_color];
1645 } else {
1646 fg = cursor->image.fg_color;
1647 bg = cursor->image.bg_color;
1648 }
1649
1650 intelfbhw_cursor_setcolor(dinfo, bg, fg);
1651 }
1652
1653 if (cursor->set & (FB_CUR_SETSHAPE | FB_CUR_SETIMAGE)) {
1654 u32 s_pitch = (ROUND_UP_TO(cursor->image.width, 8) / 8);
1655 u32 size = s_pitch * cursor->image.height;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Size is calculated here.
1656 u8 *dat = (u8 *) cursor->image.data;
1657 u8 *msk = (u8 *) cursor->mask;
1658 u8 src[64];
1659 u32 i;
1660
1661 if (cursor->image.depth != 1)
1662 return -ENXIO;
1663
1664 switch (cursor->rop) {
1665 case ROP_XOR:
1666 for (i = 0; i < size; i++)
1667 src[i] = dat[i] ^ msk[i];
1668 break;
1669 case ROP_COPY:
1670 default:
1671 for (i = 0; i < size; i++)
1672 src[i] = dat[i] & msk[i];
1673 break;
1674 }
1678 memcpy(dinfo->cursor_src, src, size);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This is what Smatch complains about. The source and dest are 64 bytes
each but it says the user can specify a size which is 128 bytes.
1679
1680 intelfbhw_cursor_load(dinfo, cursor->image.width,
1681 cursor->image.height, src);
1682 }
I am a newbie to this code so I don't know if the warning is real or not
or how to fix it. Sorry.
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
