mbox series

[0/1] fbdev: atyfb: Fix buffer overflow

Message ID 20250327100126.12585-1-arefev@swemel.ru
Headers show
Series fbdev: atyfb: Fix buffer overflow | expand

Message

Denis Arefev March 27, 2025, 10:01 a.m. UTC 
The fixes I suggested are not the only ones.
There are more options for solving this problem.

1.Find datasheet for the chip, find out the register offset, calculate
   the address using the formula (4*Dword offset), add this value to
   the array lt_lcd_regs[] at index LCD_MISC_CNTL.

2. Delete this code completely, as the chip is very obsolete and 
   not applicable.

Found by Linux Verification Center (linuxtesting.org) with SVACE.  

Denis Arefev (1):
  fbdev: atyfb: Fix buffer overflow

 drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
 1 file changed, 4 insertions(+)

base-commit: 1a9239bb4253f9076b5b4b2a1a4e8d7defd77a95

Comments

Jani Nikula March 27, 2025, 10:14 a.m. UTC | #1 
On Thu, 27 Mar 2025, Denis Arefev <arefev@swemel.ru> wrote:
> The value LCD_MISC_CNTL is used in the 'aty_st_lcd()' function to
> calculate an index for accessing an array element of size 9.
> This may cause a buffer overflow.

The fix is to fix it, not silently brush it under the carpet.

BR,
Jani.

>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Denis Arefev <arefev@swemel.ru>
> ---
>  drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
> index 210fd3ac18a4..93eb5eb6042b 100644
> --- a/drivers/video/fbdev/aty/atyfb_base.c
> +++ b/drivers/video/fbdev/aty/atyfb_base.c
> @@ -149,6 +149,8 @@ static const u32 lt_lcd_regs[] = {
>  void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
>  {
>  	if (M64_HAS(LT_LCD_REGS)) {
> +		if ((u32)index >= ARRAY_SIZE(lt_lcd_regs))
> +			return;
>  		aty_st_le32(lt_lcd_regs[index], val, par);
>  	} else {
>  		unsigned long temp;
> @@ -164,6 +166,8 @@ void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
>  u32 aty_ld_lcd(int index, const struct atyfb_par *par)
>  {
>  	if (M64_HAS(LT_LCD_REGS)) {
> +		if ((u32)index >= ARRAY_SIZE(lt_lcd_regs))
> +			return 0;
>  		return aty_ld_le32(lt_lcd_regs[index], par);
>  	} else {
>  		unsigned long temp;