Messages in this thread | | | Date | Sat, 24 Jun 2023 21:55:49 +0200 | Subject | Re: [PATCH] video: fbdev: fix potential OOB read in fast_imageblit() | From | Helge Deller <> |
| |
On 6/24/23 18:16, Zhang Shurong wrote: > There is a potential OOB read at fast_imageblit, for > "colortab[(*src >> 4)]" can become a negative value due to > "const char *s = image->data, *src". > This change makes sure the index for colortab always positive > or zero. > > Similar commit: > https://patchwork.kernel.org/patch/11746067 > > Potential bug report: > https://groups.google.com/g/syzkaller-bugs/c/9ubBXKeKXf4/m/k-QXy4UgAAAJ > > Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
applied.
Thanks! Helge
> --- > drivers/video/fbdev/core/sysimgblt.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/video/fbdev/core/sysimgblt.c b/drivers/video/fbdev/core/sysimgblt.c > index 335e92b813fc..665ef7a0a249 100644 > --- a/drivers/video/fbdev/core/sysimgblt.c > +++ b/drivers/video/fbdev/core/sysimgblt.c > @@ -189,7 +189,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, > u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel; > u32 ppw = 32/bpp, spitch = (image->width + 7)/8; > u32 bit_mask, eorx, shift; > - const char *s = image->data, *src; > + const u8 *s = image->data, *src; > u32 *dst; > const u32 *tab; > size_t tablen;
| |