From patchwork Fri Sep 1 19:05:18 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jan Vesely X-Patchwork-Id: 9935143 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 396516021C for ; Fri, 1 Sep 2017 19:05:24 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 27C2720683 for ; Fri, 1 Sep 2017 19:05:24 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1AF8328138; Fri, 1 Sep 2017 19:05:24 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 88F2B20683 for ; Fri, 1 Sep 2017 19:05:23 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id EE8C36E8C0; Fri, 1 Sep 2017 19:05:22 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-qt0-x244.google.com (mail-qt0-x244.google.com [IPv6:2607:f8b0:400d:c0d::244]) by gabe.freedesktop.org (Postfix) with ESMTPS id 9A9E26E8C0 for ; Fri, 1 Sep 2017 19:05:21 +0000 (UTC) Received: by mail-qt0-x244.google.com with SMTP id h15so833503qta.0 for ; Fri, 01 Sep 2017 12:05:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=scarletmail-rutgers-edu.20150623.gappssmtp.com; s=20150623; h=sender:from:to:cc:subject:date:message-id; bh=eOUGZhv9fv5RyQE7d7pZiUqpYfbWnM4uQzFgYMRXvxs=; b=QKqrxRN5vIoupCp3NgRvhziG/z4tM60JFIRs7D3PA/XHFTfc1otfgkZHZc3+kzFlWs sCsQ3YtGJHidiDmRoJ8NZPIw4c4HvqigIs/2JSJqY1yLK5JJF+HfLJOUAM7kMWFWV9Co 5F6oyZsa68Nyh+diSC824scBrKGkSFeFbzMxOz/hsLk2dcOH7SKmdLbMN+ukZ3r3duNZ hLn0Gh26sf6arEWTBtTtqwa8hyrdKhoIaMrMvHRz4p1oh4ioV2BqCCa1gDD0/icxAoKe qJFLGDZogAhvlMSNYWBCtnYnQDeYn2fVqiKvI65iVraCeQjm+6p1vaBb/6v3o92wPELk fPeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=eOUGZhv9fv5RyQE7d7pZiUqpYfbWnM4uQzFgYMRXvxs=; b=dmadd7VwU4KxCtlkQu1qwfvqFt1IR5j4Qk07XdAjTFZuP5s/nHJQva1CrRoBkSIeza mEHZi4z+rb4AEtBWceqHqC+ZGw164BwUZ0IZfcJ7euUMrgY9liGbOH11mZIYNfOv+2XI gOaqkMUJyn4RGy2CMVhC3oaUjRTwXfmRuyU/ESYEyIjUSb8ccHX7KciUYfnS5C4BU7v1 1+IVYqeiFt587TTWHUKNiwm9jWm+7CDTP+hC+9g4OqnB/p/0CvzcAeqeQR/3/ho4J8bX HFY/bswWMUyelyY0eHVmJoClVg4k9djuurspqZQyiswfFNIC7CG39xpiBpo9QLir0Qoe YA3g== X-Gm-Message-State: AHPjjUj4rw7HGv6754ObjMmsuy+nka5KQ7cu6okGSTvollNLPgah6HgP qBw+Q1DeqKhjaUHi+o0x2w== X-Google-Smtp-Source: ADKCNb7e2rz5P9UPZG+onZVgAr0VZL/c9gWYWPLMenY25rtNmNPuoGdoOYrj28Mlwo9IsL39OyGIuQ== X-Received: by 10.200.28.29 with SMTP id a29mr4484636qtk.318.1504292720501; Fri, 01 Sep 2017 12:05:20 -0700 (PDT) Received: from adriatix.rutgers.edu (pool-128-6-37-254.nat.rutgers.edu. [128.6.37.254]) by smtp.gmail.com with ESMTPSA id q2sm600395qti.45.2017.09.01.12.05.19 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 01 Sep 2017 12:05:19 -0700 (PDT) From: Jan Vesely To: dri-devel@lists.freedesktop.org Subject: [PATCH libdrm 1/1] amdgpu: Do not write beyond allocated memory when parsing ids Date: Fri, 1 Sep 2017 15:05:18 -0400 Message-Id: <20170901190518.14934-1-jan.vesely@rutgers.edu> X-Mailer: git-send-email 2.13.5 Cc: michel@daenzer.net X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Fixes crash when/usr/share/libdrm/amdgpu.ids contains ASIC_ID_TABLE_NUM_ENTRIES + 1 entries. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102432 Signed-off-by: Jan Vesely Reviewed-by: Michel Dänzer --- Compile tested only. amdgpu/amdgpu_asic_id.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/amdgpu/amdgpu_asic_id.c b/amdgpu/amdgpu_asic_id.c index 3a88896b..e8218974 100644 --- a/amdgpu/amdgpu_asic_id.c +++ b/amdgpu/amdgpu_asic_id.c @@ -186,19 +186,20 @@ int amdgpu_parse_asic_ids(struct amdgpu_asic_id **p_asic_id_table) table_size++; } - /* end of table */ - id = asic_id_table + table_size; - memset(id, 0, sizeof(struct amdgpu_asic_id)); - if (table_size != table_max_size) { id = realloc(asic_id_table, (table_size + 1) * sizeof(struct amdgpu_asic_id)); - if (!id) + if (!id) { r = -ENOMEM; - else - asic_id_table = id; + goto free; + } + asic_id_table = id; } + /* end of table */ + id = asic_id_table + table_size; + memset(id, 0, sizeof(struct amdgpu_asic_id)); + free: free(line);