blob: 03c4bbc2c59c9644c707255d61bc772cf305d5a6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
From 80090ba2d9eab1de4eb09ca5d40697b0f039a9c9 Mon Sep 17 00:00:00 2001
From: John Lindgren <john.lindgren@tds.net>
Date: Tue, 22 Mar 2011 18:15:10 -0400
Subject: [PATCH] drm/radeon/kms: add some sanity checks to obj info record parsing
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=35502
agd5f: also add sanity check to connector records.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
---
drivers/gpu/drm/radeon/radeon_atombios.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 4a92b6d..793bbd7 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -678,7 +678,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
ATOM_ENCODER_CAP_RECORD *cap_record;
u16 caps = 0;
- while (record->ucRecordType > 0 &&
+ while (record->ucRecordSize > 0 &&
+ record->ucRecordType > 0 &&
record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
switch (record->ucRecordType) {
case ATOM_ENCODER_CAP_RECORD_TYPE:
@@ -723,7 +724,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
break;
}
- while (record->ucRecordType > 0 &&
+ while (record->ucRecordSize > 0 &&
+ record->ucRecordType > 0 &&
record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
switch (record->ucRecordType) {
case ATOM_I2C_RECORD_TYPE:
--
1.7.1.1
|
