CVS commit: src/sys

[Nick Hudson]

Module Name:    src
Committed By:   skrll
Date:           Tue Mar  2 07:02:06 UTC 2021

Modified Files:
        src/sys/arch/arm/fdt: arm_simplefb.c
        src/sys/dev/fdt: simplefb.c

Log Message:
Sanity check size vs width x height x depth.  Buggy firmware exists.


To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 src/sys/arch/arm/fdt/arm_simplefb.c
cvs rdiff -u -r1.12 -r1.13 src/sys/dev/fdt/simplefb.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/arch/arm/fdt/arm_simplefb.c
diff -u src/sys/arch/arm/fdt/arm_simplefb.c:1.8 src/sys/arch/arm/fdt/arm_simplefb.c:1.9
--- src/sys/arch/arm/fdt/arm_simplefb.c:1.8	Wed Jan 27 03:10:19 2021
+++ src/sys/arch/arm/fdt/arm_simplefb.c	Tue Mar  2 07:02:05 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: arm_simplefb.c,v 1.8 2021/01/27 03:10:19 thorpej Exp $ */
+/* $NetBSD: arm_simplefb.c,v 1.9 2021/03/02 07:02:05 skrll Exp $ */
 
 /*-
  * Copyright (c) 2019 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
 #include "opt_vcons.h"
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: arm_simplefb.c,v 1.8 2021/01/27 03:10:19 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: arm_simplefb.c,v 1.9 2021/03/02 07:02:05 skrll Exp $");
 
 #include <sys/param.h>
 #include <sys/bus.h>
@@ -237,6 +237,9 @@ arm_simplefb_preattach(void)
 		return;
 	}
 
+	if (size < width * height * depth)
+		return;
+
 	if (bus_space_map(bst, addr, size,
 	    BUS_SPACE_MAP_LINEAR | BUS_SPACE_MAP_PREFETCHABLE, &bsh) != 0)
 		return;

Index: src/sys/dev/fdt/simplefb.c
diff -u src/sys/dev/fdt/simplefb.c:1.12 src/sys/dev/fdt/simplefb.c:1.13
--- src/sys/dev/fdt/simplefb.c:1.12	Wed Jan 27 03:10:21 2021
+++ src/sys/dev/fdt/simplefb.c	Tue Mar  2 07:02:06 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: simplefb.c,v 1.12 2021/01/27 03:10:21 thorpej Exp $ */
+/* $NetBSD: simplefb.c,v 1.13 2021/03/02 07:02:06 skrll Exp $ */
 
 /*-
  * Copyright (c) 2017 Jared McNeill <jmcne...@invisible.ca>
@@ -29,7 +29,7 @@
 #include "opt_wsdisplay_compat.h"
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: simplefb.c,v 1.12 2021/01/27 03:10:21 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: simplefb.c,v 1.13 2021/03/02 07:02:06 skrll Exp $");
 
 #include <sys/param.h>
 #include <sys/bus.h>
@@ -169,6 +169,11 @@ simplefb_attach_genfb(struct simplefb_so
 		return ENXIO;
 	}
 
+	if (size < width * height * depth) {
+		aprint_error(": incorrect size\n");
+		return ENXIO;
+	}
+
 	/* Device may have been reconfigured. MD code will tell us. */
 	if (prop_dictionary_get_uint64(dict, "simplefb-physaddr", &sfb_addr) &&
 	    sfb_addr != 0) {