DragonFlyBSD Kernel Audit
DF-1837 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
--- a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -580,6 +580,13 @@
 		if (!edid)
 			return EDID_NO_RESPONSE;
 
+		/* edid->extensions is a u8 (0..255); EDID_LENGTH is 128 bytes.
+		 * raw_edid[] has room for DC_MAX_EDID_BUFFER_SIZE=512 bytes (4
+		 * blocks).  Cap the length and reject oversized EDIDs, mirroring
+		 * the sibling dc.c:1774 check. */
+		if (edid->extensions + 1 > DC_MAX_EDID_BUFFER_SIZE / EDID_LENGTH)
+			return EDID_NO_RESPONSE;
+
 		sink->dc_edid.length = EDID_LENGTH * (edid->extensions + 1);
 		memmove(sink->dc_edid.raw_edid, (uint8_t *)edid, sink->dc_edid.length);