DF-2083 / fix.diff
diff --git a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c --- a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c +++ b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c @@ -257,7 +257,12 @@ } lut = (struct drm_color_lut *)blob->data; - if (__is_lut_linear(lut, MAX_COLOR_LUT_ENTRIES)) { + lut_size = blob->length / sizeof(struct drm_color_lut); + if (lut_size == 0 || lut_size > MAX_COLOR_LUT_ENTRIES) { + DRM_ERROR("Invalid degamma LUT size\n"); + return -EINVAL; + } + if (__is_lut_linear(lut, lut_size)) { dc_plane_state->in_transfer_func->type = TF_TYPE_BYPASS; dc_plane_state->in_transfer_func->tf = TRANSFER_FUNCTION_LINEAR; return 0; @@ -267,7 +272,6 @@ if (!gamma) return -ENOMEM; - lut_size = blob->length / sizeof(struct drm_color_lut); gamma->num_entries = lut_size; if (gamma->num_entries == MAX_COLOR_LUT_ENTRIES) gamma->type = GAMMA_CUSTOM; |