From patchwork Thu Mar 24 17:11:02 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Deucher X-Patchwork-Id: 659301 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p2OHBY4R029438 for ; Thu, 24 Mar 2011 17:11:54 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id C325A9F043 for ; Thu, 24 Mar 2011 10:11:33 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-vw0-f49.google.com (mail-vw0-f49.google.com [209.85.212.49]) by gabe.freedesktop.org (Postfix) with ESMTP id B1C9A9E7C8 for ; Thu, 24 Mar 2011 10:11:25 -0700 (PDT) Received: by vws8 with SMTP id 8so198446vws.36 for ; Thu, 24 Mar 2011 10:11:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer; bh=jbPbAp1aBS9izEruROZfjo0FxqEGr5+gg95s6qQtmz8=; b=wKcSwR0fhjYX4G7GlxS+8MI+cr0bQ6a/t45G9dE5afLeDw3p7y5iT7bqlMmQ5AjeO/ Mohy7L9+aT+9TaspiFauejQJ3IKV9O3winZT/NTKJ6od6ggginjr/Ir98x/l7eg1n+LB F1zULW+dUOYR9eDWkS8ezmjZpwNx9PUjZ7RK0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; b=KaU6lbAjfjgCytbbx9mufmKU9KrXpY5zj6SnRDN2Hwj8MlbVS+5oLzUy1vNOvif8sY 1A2++5hT7SrNSgGINWJSaxn06x18iBIpEEjV4X6KIBtcxX3JEKEGAFKioz21wFgGx3/Y sBwtr4TY6wLfRfT+fj7YcZNEUEq4BSSlYL/hI= Received: by 10.52.69.140 with SMTP id e12mr2008570vdu.187.1300986684895; Thu, 24 Mar 2011 10:11:24 -0700 (PDT) Received: from localhost.localdomain (static-74-96-105-7.washdc.fios.verizon.net [74.96.105.7]) by mx.google.com with ESMTPS id w26sm35210vcf.21.2011.03.24.10.11.24 (version=SSLv3 cipher=OTHER); Thu, 24 Mar 2011 10:11:24 -0700 (PDT) From: Alex Deucher To: airlied@gmail.com, dri-devel@lists.freedesktop.org Subject: [PATCH] drm/radeon/kms: add some sanity checks to obj info record parsing Date: Thu, 24 Mar 2011 13:11:02 -0400 Message-Id: <1300986662-8457-1-git-send-email-alexdeucher@gmail.com> X-Mailer: git-send-email 1.7.1.1 Cc: stable@kernel.org, John Lindgren X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Thu, 24 Mar 2011 17:11:54 +0000 (UTC) diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c index 4a92b6d..793bbd7 100644 --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -678,7 +678,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) ATOM_ENCODER_CAP_RECORD *cap_record; u16 caps = 0; - while (record->ucRecordType > 0 && + while (record->ucRecordSize > 0 && + record->ucRecordType > 0 && record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) { switch (record->ucRecordType) { case ATOM_ENCODER_CAP_RECORD_TYPE: @@ -723,7 +724,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) break; } - while (record->ucRecordType > 0 && + while (record->ucRecordSize > 0 && + record->ucRecordType > 0 && record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) { switch (record->ucRecordType) { case ATOM_I2C_RECORD_TYPE: