Bound atom_find_str_in_rom() by the BIOS size to avoid out-of-bounds reads.
Signed-off-by: Lijo Lazar <[email protected]> --- drivers/gpu/drm/amd/amdgpu/atom.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c index d18e46422520..07a33f94ed6a 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.c +++ b/drivers/gpu/drm/amd/amdgpu/atom.c @@ -1449,8 +1449,8 @@ static void atom_get_vbios_date(struct atom_context *ctx) ctx->date[16] = '\0'; } -static unsigned char *atom_find_str_in_rom(struct atom_context *ctx, char *str, int start, - int end, int maxlen) +static unsigned char *atom_find_str_in_rom(struct atom_context *ctx, char *str, u32 start, + u32 end, int maxlen) { unsigned long str_off; unsigned char *p_rom; @@ -1460,6 +1460,9 @@ static unsigned char *atom_find_str_in_rom(struct atom_context *ctx, char *str, str_len = strnlen(str, maxlen); p_rom = ctx->bios; + if (end + str_len > ctx->bios_size) + return NULL; + for (; start <= end; ++start) { for (str_off = 0; str_off < str_len; ++str_off) { if (str[str_off] != *(p_rom + start + str_off)) -- 2.49.0
