diff --git a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c --- a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c +++ b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c @@ -580,6 +580,13 @@ if (!edid) return EDID_NO_RESPONSE; + /* edid->extensions is a u8 (0..255); EDID_LENGTH is 128 bytes. + * raw_edid[] has room for DC_MAX_EDID_BUFFER_SIZE=512 bytes (4 + * blocks). Cap the length and reject oversized EDIDs, mirroring + * the sibling dc.c:1774 check. */ + if (edid->extensions + 1 > DC_MAX_EDID_BUFFER_SIZE / EDID_LENGTH) + return EDID_NO_RESPONSE; + sink->dc_edid.length = EDID_LENGTH * (edid->extensions + 1); memmove(sink->dc_edid.raw_edid, (uint8_t *)edid, sink->dc_edid.length);