dlfb_parse_vendor_descriptor() walks key-length-value items inside the DisplayLink vendor descriptor.
Require each item to contain its key, length and declared value bytes before reading item-specific fields such as max_area. Signed-off-by: Pengpeng Hou <[email protected]> --- drivers/video/fbdev/udlfb.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c index fdbb8671a810..e78d6f95c9c5 100644 --- a/drivers/video/fbdev/udlfb.c +++ b/drivers/video/fbdev/udlfb.c @@ -1586,19 +1586,29 @@ static int dlfb_parse_vendor_descriptor(struct dlfb_data *dlfb, desc += 5; /* the fixed header we've already parsed */ while (desc < desc_end) { + char *value; u8 length; u16 key; - key = *desc++; - key |= (u16)*desc++ << 8; + if (desc_end - desc < sizeof(key) + sizeof(length)) + goto unrecognized; + + key = get_unaligned_le16(desc); + desc += sizeof(key); length = *desc++; + if (length > desc_end - desc) + goto unrecognized; + + value = desc; switch (key) { case 0x0200: { /* max_area */ - u32 max_area = *desc++; - max_area |= (u32)*desc++ << 8; - max_area |= (u32)*desc++ << 16; - max_area |= (u32)*desc++ << 24; + u32 max_area; + + if (length < sizeof(max_area)) + goto unrecognized; + + max_area = get_unaligned_le32(value); dev_warn(&intf->dev, "DL chip limited to %d pixel modes\n", max_area); -- 2.43.0
