DragonFlyBSD Kernel Audit
DF-1754 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/radeon/radeon_vce.c b/sys/dev/drm/radeon/radeon_vce.c
--- a/sys/dev/drm/radeon/radeon_vce.c
+++ b/sys/dev/drm/radeon/radeon_vce.c
@@ -485,6 +485,14 @@
 		return -EINVAL;
 	}
 
+	/* DF-1754: chunk_relocs->length_dw may not be a multiple of 4;
+	 * admit only 4-dword-aligned indices that fit within nrelocs. */
+	if ((idx % 4) != 0 || idx / 4 >= p->nrelocs) {
+		DRM_ERROR("VCE relocs idx %d not aligned / past nrelocs %d!\n",
+			  idx, p->nrelocs);
+		return -EINVAL;
+	}
+
 	reloc = &p->relocs[(idx / 4)];
 	start = reloc->gpu_offset;
 	end = start + radeon_bo_size(reloc->robj);