lkml.org 
[lkml]   [2021]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check
Date
yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range.
This is an out-of-bounds write bug.


diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 22bb3892f6bd..0970de46782f 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1956,11 +1956,12 @@ static void updatescrollmode(struct fbcon_display *p,
int yres = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
int vyres = FBCON_SWAP(ops->rotate, info->var.yres_virtual,
info->var.xres_virtual);
+ int rows = vc->vc_rows;

p->vrows = vyres/fh;
- if (yres > (fh * (vc->vc_rows + 1)))
- p->vrows -= (yres - (fh * vc->vc_rows)) / fh;
- if ((yres % fh) && (vyres % fh < yres % fh))
+ if ((yres > (fh * (rows + 1))) && (vyres >= (yres - (fh * rows))) && p->vrows)
+ p->vrows -= (yres - (fh * rows)) / fh;
+ if ((yres % fh) && (vyres % fh < yres % fh) && p->vrows)
p->vrows--;
}

\
 
 \ /
  Last update: 2021-07-26 13:42    [W:0.068 / U:1.604 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site