vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()
There are two issues in vmw_kms_update_layout_ioctl(). First, the for loop forgets to index rects and only checks the first element. Second, there is a potential integer overflow if userspace passes in a large arg->num_outputs. The call to kzalloc() would allocate a small buffer, leading to out-of-bounds read. Reported-by: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
parent
f3a71df050
commit
bab9efc206
|
@ -1809,7 +1809,8 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
|
|||
}
|
||||
|
||||
rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
|
||||
rects = kzalloc(rects_size, GFP_KERNEL);
|
||||
rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
|
||||
GFP_KERNEL);
|
||||
if (unlikely(!rects)) {
|
||||
ret = -ENOMEM;
|
||||
goto out_unlock;
|
||||
|
@ -1824,10 +1825,10 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
|
|||
}
|
||||
|
||||
for (i = 0; i < arg->num_outputs; ++i) {
|
||||
if (rects->x < 0 ||
|
||||
rects->y < 0 ||
|
||||
rects->x + rects->w > mode_config->max_width ||
|
||||
rects->y + rects->h > mode_config->max_height) {
|
||||
if (rects[i].x < 0 ||
|
||||
rects[i].y < 0 ||
|
||||
rects[i].x + rects[i].w > mode_config->max_width ||
|
||||
rects[i].y + rects[i].h > mode_config->max_height) {
|
||||
DRM_ERROR("Invalid GUI layout.\n");
|
||||
ret = -EINVAL;
|
||||
goto out_free;
|
||||
|
|
Loading…
Reference in a new issue