⬢ DragonFlyBSD Kernel Audit
DF-5052 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/display/dc/basics/vector.c b/sys/dev/drm/amd/display/dc/basics/vector.c
--- a/sys/dev/drm/amd/display/dc/basics/vector.c
+++ b/sys/dev/drm/amd/display/dc/basics/vector.c
@@ -132,6 +132,7 @@
 	struct vector *vector)
 {
 	kfree(vector->container);
+	vector->container = NULL;
 	vector->count = 0;
 	vector->capacity = 0;
 }
@@ -207,6 +208,11 @@
 	uint32_t position)
 {
 	uint8_t *insert_address;
+
+	if (position > vector->count) {
+		BREAK_TO_DEBUGGER();
+		return false;
+	}
 
 	if (vector->count == vector->capacity) {
 		if (!dal_vector_reserve(
diff --git a/sys/dev/drm/amd/display/include/vector.h b/sys/dev/drm/amd/display/include/vector.h
--- a/sys/dev/drm/amd/display/include/vector.h
+++ b/sys/dev/drm/amd/display/include/vector.h
@@ -66,9 +66,7 @@
  * reallocate container if necessary
  * then shell items at right and insert
  * return if the container modified
- * do not check that index belongs to container
- * since the function is private and index is going to be calculated
- * either with by function or as get_count+1 */
+ * reject positions beyond count (position == count appends) */
 bool dal_vector_insert_at(
 	struct vector *vector,
 	const void *what,