From patchwork Thu Mar 24 23:28:31 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Deucher X-Patchwork-Id: 660711 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p2ONSnaX005820 for ; Thu, 24 Mar 2011 23:29:11 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 469E59E912 for ; Thu, 24 Mar 2011 16:28:49 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-vw0-f49.google.com (mail-vw0-f49.google.com [209.85.212.49]) by gabe.freedesktop.org (Postfix) with ESMTP id 6055E9E709 for ; Thu, 24 Mar 2011 16:28:41 -0700 (PDT) Received: by vws8 with SMTP id 8so523380vws.36 for ; Thu, 24 Mar 2011 16:28:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer :in-reply-to:references; bh=Tv4z/Xucsww7pOud5dkyaBqd0vYZfXOxE1PWUdpu1pg=; b=JASHhOqM5TBdWiDhFyE/jTW8lZueiGLpxQtnDg95+VK70fjF+tAidByOmVwA11+sL3 iHe95Z4MjUxqS/6UthInsAJ8ZEumxiK2urLefxosY54P4nWGu3reT4vrYxn9Vhspx7/W uQHSYNk5kBnTwYU4CrADShWEOIPwXU13izbS0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; b=aak5yDdeRFTwk7zmmq6Qq76gqMz+s/MF6sGdVbm8nqiTgLut4Pu5PNTzp2ARc/bkof iND3SkswRW6VKynrjtoXL0Zcw9/MMazdQCUjqPwEDc/tQKe1Ayn4jAAuTetBAXytrN03 JY6mZTL1b4Pdv6TP6JoU5+D+9N7z4Yw7eqZr8= Received: by 10.52.0.101 with SMTP id 5mr101690vdd.293.1301009320543; Thu, 24 Mar 2011 16:28:40 -0700 (PDT) Received: from localhost.localdomain (static-74-96-105-7.washdc.fios.verizon.net [74.96.105.7]) by mx.google.com with ESMTPS id eh10sm192912vbb.14.2011.03.24.16.28.39 (version=SSLv3 cipher=OTHER); Thu, 24 Mar 2011 16:28:39 -0700 (PDT) From: Alex Deucher To: airlied@gmail.com, dri-devel@lists.freedesktop.org Subject: [PATCH] drm/radeon/kms: add some sanity checks to obj info record parsingi (v2) Date: Thu, 24 Mar 2011 19:28:31 -0400 Message-Id: <1301009311-14311-1-git-send-email-alexdeucher@gmail.com> X-Mailer: git-send-email 1.7.1.1 In-Reply-To: <1300986662-8457-1-git-send-email-alexdeucher@gmail.com> References: <1300986662-8457-1-git-send-email-alexdeucher@gmail.com> Cc: stable@kernel.org, John Lindgren X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Thu, 24 Mar 2011 23:29:11 +0000 (UTC) diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c index 4a92b6d..150fbdd 100644 --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -678,7 +678,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) ATOM_ENCODER_CAP_RECORD *cap_record; u16 caps = 0; - while (record->ucRecordType > 0 && + while (record->ucRecordSize > 0 && + record->ucRecordType > 0 && record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) { switch (record->ucRecordType) { case ATOM_ENCODER_CAP_RECORD_TYPE: @@ -723,7 +724,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) break; } - while (record->ucRecordType > 0 && + while (record->ucRecordSize > 0 && + record->ucRecordType > 0 && record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) { switch (record->ucRecordType) { case ATOM_I2C_RECORD_TYPE: @@ -785,10 +787,9 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) ATOM_HPD_INT_RECORD *hpd_record; ATOM_I2C_ID_CONFIG_ACCESS *i2c_config; - while (record->ucRecordType > 0 - && record-> - ucRecordType <= - ATOM_MAX_OBJECT_RECORD_NUMBER) { + while (record->ucRecordSize > 0 && + record->ucRecordType > 0 && + record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) { switch (record->ucRecordType) { case ATOM_I2C_RECORD_TYPE: i2c_record =