evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: hdmi: validate HDMI EDID's max number of CEA blocks

Browse source 
No upper-bound validation is performed when reading number of
extended CEA blocks from the untrusted source (EDID). Add a check
to limit the number of CEA extension blocks.

Change-Id: I69f09ed0ad28a4c267cf3e8f7a12efe46f75e244
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
This commit is contained in:
Narender Ankam 2017-08-23 12:30:01 +05:30
parent 2d7191e18b
commit e465963e36
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/video/fbdev/msm/mdss_hdmi_edid.c
View file

@ -2322,6 +2322,13 @@ int hdmi_edid_parser(void *input)
goto bail; goto bail;
} }
/* Find out if CEA extension blocks exceeding max limit */
if (num_of_cea_blocks >= MAX_EDID_BLOCKS) {
DEV_WARN("%s: HDMI EDID exceeded max CEA blocks limit\n",
__func__);
num_of_cea_blocks = MAX_EDID_BLOCKS - 1;
}
/* check for valid CEA block */ /* check for valid CEA block */
if (edid_buf[EDID_BLOCK_SIZE] != 2) { if (edid_buf[EDID_BLOCK_SIZE] != 2) {
DEV_ERR("%s: Invalid CEA block\n", __func__); DEV_ERR("%s: Invalid CEA block\n", __func__);