diff options
| author | Tomi Valkeinen <tomi.valkeinen@ti.com> | 2015-01-15 12:47:19 +0100 |
|---|---|---|
| committer | Tomi Valkeinen <tomi.valkeinen@ti.com> | 2015-08-20 09:20:11 +0200 |
| commit | 6080a89357cc46f3450839a84af75c3d18f57772 (patch) | |
| tree | 9501a62b245f3dac2bd386d1e6e75b4879231254 | |
| parent | Linux 4.2-rc7 (diff) | |
| download | linux-6080a89357cc46f3450839a84af75c3d18f57772.tar.xz linux-6080a89357cc46f3450839a84af75c3d18f57772.zip | |
fbdev: fix cea_modes array size
CEA defines 64 modes, indexed from 1 to 64. modedb has cea_modes arrays,
which contains 64 entries. However, the code uses the CEA indices
directly, i.e. the first mode is at cea_modes[1]. This means the array
is one too short.
This does not cause references to uninitialized memory as the code in
fbmon only allows indexes up to 63, and the cea_modes does not contain
an entry for the mode 64 so it could not be used in any case.
However, the code contains a check 'if (idx > ARRAY_SIZE(cea_modes)',
and while that check is a no-op as at that point idx cannot be >= 63, it
upsets static checkers.
Fix this by increasing the cea_array size to be 65, and change the code
to allow mode 64.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
| -rw-r--r-- | drivers/video/fbdev/core/fbmon.c | 4 | ||||
| -rw-r--r-- | drivers/video/fbdev/core/modedb.c | 2 | ||||
| -rw-r--r-- | include/linux/fb.h | 2 |
3 files changed, 4 insertions, 4 deletions
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c index d787533d9c8b..47c3191ec313 100644 --- a/drivers/video/fbdev/core/fbmon.c +++ b/drivers/video/fbdev/core/fbmon.c @@ -1072,9 +1072,9 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs) for (i = specs->modedb_len + num; i < specs->modedb_len + num + svd_n; i++) { int idx = svd[i - specs->modedb_len - num]; - if (!idx || idx > 63) { + if (!idx || idx >= ARRAY_SIZE(cea_modes)) { pr_warning("Reserved SVD code %d\n", idx); - } else if (idx > ARRAY_SIZE(cea_modes) || !cea_modes[idx].xres) { + } else if (!cea_modes[idx].xres) { pr_warning("Unimplemented SVD code %d\n", idx); } else { memcpy(&m[i], cea_modes + idx, sizeof(m[i])); diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c index 7d07cf824b64..2510fa728d77 100644 --- a/drivers/video/fbdev/core/modedb.c +++ b/drivers/video/fbdev/core/modedb.c @@ -289,7 +289,7 @@ static const struct fb_videomode modedb[] = { }; #ifdef CONFIG_FB_MODE_HELPERS -const struct fb_videomode cea_modes[64] = { +const struct fb_videomode cea_modes[65] = { /* #1: 640x480p@59.94/60Hz */ [1] = { NULL, 60, 640, 480, 39722, 48, 16, 33, 10, 96, 2, 0, diff --git a/include/linux/fb.h b/include/linux/fb.h index 043f3283b71c..bc9afa74ee11 100644 --- a/include/linux/fb.h +++ b/include/linux/fb.h @@ -788,7 +788,7 @@ struct dmt_videomode { extern const char *fb_mode_option; extern const struct fb_videomode vesa_modes[]; -extern const struct fb_videomode cea_modes[64]; +extern const struct fb_videomode cea_modes[65]; extern const struct dmt_videomode dmt_modes[]; struct fb_modelist { |