shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 03:40:35 +09:00
Code Issues Packages Projects Releases Wiki Activity

hdmitx: fix KASAN Bug in hdmitx_edid_parse [1/1]

Browse Source 
PD#173547: hdmitx: fix KASAN Bug in hdmitx_edid_parse
BUG: KASAN: stack-out-of-bounds in hdmitx_edid_parse+0x22c/0x2c40
Read of size 1 at addr ffffffc047927a4f by task power@1.0-servi/2947

Change-Id: Ia1dda5aa80a9fc33a0e81eb9af51ea42a3731c66
Signed-off-by: Kaifu Hu <kaifu.hu@amlogic.com>
This commit is contained in:
Kaifu Hu
2018-09-18 14:04:41 +08:00
committed by Tao Zeng
parent 09b8979dfd
commit fe9bb59845
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/amlogic/media/vout/hdmitx/hdmi_tx_20/hdmi_tx_edid.c
View File

@@ -136,6 +136,10 @@ static void Edid_ParsingIDManufacturerName(struct rx_cap *pRxCap,
brand[1] = ((data[0] & 0x3) << 3) + (data[1] >> 5);
brand[2] = data[1] & 0x1f;
if (((brand[0] > 26) || (brand[0] == 0))
|| ((brand[1] > 26) || (brand[1] == 0))
|| ((brand[2] > 26) || (brand[2] == 0)))
return;
for (i = 0; i < 3; i++)
pRxCap->IDManufacturerName[i] = uppercase[brand[i] - 1];
}

5
drivers/amlogic/media/vout/hdmitx/hdmi_tx_20/hdmi_tx_main.c
View File

@@ -596,7 +596,8 @@ static ssize_t show_attr(struct device *dev,
ssize_t store_attr(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
memcpy(hdmitx_device.fmt_attr, buf, sizeof(hdmitx_device.fmt_attr));
strncpy(hdmitx_device.fmt_attr, buf, sizeof(hdmitx_device.fmt_attr));
hdmitx_device.fmt_attr[15] = '\0';
return count;
}
/*aud_mode attr*/
@@ -2244,6 +2245,7 @@ static ssize_t show_hdr_cap(struct device *dev,
int pos = 0;
unsigned int i, j;
struct rx_cap *pRXCap = &(hdmitx_device.RXCap);
pos += snprintf(buf + pos, PAGE_SIZE, "HDR Static Metadata:\n");
pos += snprintf(buf + pos, PAGE_SIZE, " Supported EOTF:\n");
pos += snprintf(buf + pos, PAGE_SIZE, " Traditional SDR: %d\n",
@@ -3324,6 +3326,7 @@ static void clear_hdr_info(struct hdmitx_dev *hdev)
{
struct vinfo_s *info = hdmitx_get_current_vinfo();
unsigned int i;
if (info) {
info->hdr_info.hdr_support = 0;
for (i = 0; i < 4; i++)