⬢ DragonFlyBSD Kernel Audit
DF-4220 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/display/modules/color/color_gamma.c
+++ b/sys/dev/drm/amd/display/modules/color/color_gamma.c
@@ -1073,8 +1073,7 @@ static void build_evenly_distributed_points(
 	struct gamma_pixel *p_last;
 
 	uint32_t i = 0;
 
-	// This function should not gets called with 0 as a parameter
-	ASSERT(numberof_points > 0);
+	if (numberof_points < 2)	/* n-1 must divide; n+3 extras must fit */
+		return;
 	p_last = p + numberof_points - 1;
 
 	do {
@@ -1371,8 +1370,8 @@ bool mod_color_calculate_regamma_params(struct dc_transfer_func *output_tf,
 	if (output_tf->type == TF_TYPE_BYPASS)
 		return false;
 
+	if (ramp->num_entries < 2)
+		return false;
 	/* we can use hardcoded curve for plain SRGB TF */
 	if (output_tf->type == TF_TYPE_PREDEFINED && canRomBeUsed == true &&
 			output_tf->tf == TRANSFER_FUNCTION_SRGB &&
@@ -1581,8 +1580,9 @@ bool mod_color_calculate_degamma_params(struct dc_transfer_func *input_tf,
 	if (input_tf->type == TF_TYPE_BYPASS)
 		return false;
 
 	/* we can use hardcoded curve for plain SRGB TF */
 	if (input_tf->type == TF_TYPE_PREDEFINED &&
 			input_tf->tf == TRANSFER_FUNCTION_SRGB &&
 			(!mapUserRamp &&
 			(ramp->type == GAMMA_RGB_256 || ramp->num_entries == 0)))
 		return true;
 
+	if (ramp->num_entries < 2)
+		return false;
 	input_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
 
 	rgb_user = kcalloc(ramp->num_entries + _EXTRA_POINTS,