⬢ DragonFlyBSD Kernel Audit
DF-4827 / fix.diff
← back to finding ↓ download raw
--- a/dce_i2c_sw.c
+++ b/dce_i2c_sw.c
@@ -532,7 +532,14 @@
 	enum gpio_ddc_line line;
 	struct dce_i2c_sw *engine = NULL;
 
-	if (get_hw_supported_ddc_line(ddc, &line))
+	/*
+	 * sw_i2cs[] is sized MAX_PIPES, NOT GPIO_DDC_LINE_COUNT - the
+	 * VGA (6) and I2C-pad (7) DDC lines pass get_hw_supported_ddc_line's
+	 * GPIO_DDC_LINE_COUNT bound but would index past the array into the
+	 * scalar members of resource_pool. Bound by the array domain, as
+	 * acquire_i2c_hw_engine() already does for hw_i2cs[] (dce_i2c_hw.c).
+	 */
+	if (get_hw_supported_ddc_line(ddc, &line) && line < pool->pipe_count)
 		engine = pool->sw_i2cs[line];
 
 	if (!engine)