mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 10:31:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

fbdev: udlfb: validate vendor descriptor items

Browse Source 
dlfb_parse_vendor_descriptor() walks key-length-value items inside the
DisplayLink vendor descriptor.

Require each item to contain its key, length and declared value bytes
before reading item-specific fields such as max_area.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
This commit is contained in:
Pengpeng Hou
2026-07-06 17:30:38 +08:00
committed by Helge Deller
parent 74c09634a5
commit 3cc2fad376
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/video/fbdev/udlfb.c
View File

@@ -1586,19 +1586,29 @@ static int dlfb_parse_vendor_descriptor(struct dlfb_data *dlfb,
desc += 5; /* the fixed header we've already parsed */
while (desc < desc_end) {
char *value;
u8 length;
u16 key;
key = *desc++;
key |= (u16)*desc++ << 8;
if (desc_end - desc < sizeof(key) + sizeof(length))
goto unrecognized;
key = get_unaligned_le16(desc);
desc += sizeof(key);
length = *desc++;
if (length > desc_end - desc)
goto unrecognized;
value = desc;
switch (key) {
case 0x0200: { /* max_area */
u32 max_area = *desc++;
max_area |= (u32)*desc++ << 8;
max_area |= (u32)*desc++ << 16;
max_area |= (u32)*desc++ << 24;
u32 max_area;
if (length < sizeof(max_area))
goto unrecognized;
max_area = get_unaligned_le32(value);
dev_warn(&intf->dev,
"DL chip limited to %d pixel modes\n",
max_area);