DragonFlyBSD Kernel Audit
DF-2083 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
--- a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+++ b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
@@ -257,7 +257,12 @@
 	}
 
 	lut = (struct drm_color_lut *)blob->data;
-	if (__is_lut_linear(lut, MAX_COLOR_LUT_ENTRIES)) {
+	lut_size = blob->length / sizeof(struct drm_color_lut);
+	if (lut_size == 0 || lut_size > MAX_COLOR_LUT_ENTRIES) {
+		DRM_ERROR("Invalid degamma LUT size\n");
+		return -EINVAL;
+	}
+	if (__is_lut_linear(lut, lut_size)) {
 		dc_plane_state->in_transfer_func->type = TF_TYPE_BYPASS;
 		dc_plane_state->in_transfer_func->tf = TRANSFER_FUNCTION_LINEAR;
 		return 0;
@@ -267,7 +272,6 @@
 	if (!gamma)
 		return -ENOMEM;
 
-	lut_size = blob->length / sizeof(struct drm_color_lut);
 	gamma->num_entries = lut_size;
 	if (gamma->num_entries == MAX_COLOR_LUT_ENTRIES)
 		gamma->type = GAMMA_CUSTOM;