• Gustavo A. R. Silva's avatar
    drm/i915/gvt/fb_decoder: Fix out-of-bounds read · 461bd622
    Gustavo A. R. Silva authored
    In case function skl_format_to_drm returns -EINVAL, fmt turns into a huge
    number as fmt is of type u32, hence there is an out-of-bounds read when
    using fmt as an index for array skl_pixel_formats at line 225:
    plane->bpp = skl_pixel_formats[fmt].bpp;
    
    Fix this by comparing the value returned by function skl_format_to_drm
    against the size of array skl_pixel_formats, so in case it is greater than
    or equal to the number of items contained in skl_pixel_formats, print an
    error message and return -EINVAL.
    
    Addresses-Coverity-ID: 1462495
    Addresses-Coverity-ID: 1462502 ("Out-of-bounds read")
    Fixes: 9f31d106 ("drm/i915/gvt: Add framebuffer decoder support")
    Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
    Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
    461bd622
fb_decoder.c 14.4 KB