GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

src/lib/edid: avoid buffer overflow 

It's more theoretical, but lest somebody calls extract_string()
with too large a length...

Change-Id: I3934bd6965318cdffe5c636b01b3e0c4426e8d1d
Signed-off-by: Patrick Georgi <pgeorgi@google.com>
Found-by: Coverity Scan #1374795
Reviewed-on: https://review.coreboot.org/28659
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Patrick Georgi 2018-09-18 18:01:02 +02:00
parent d13b41124b
commit d840e2b3f0
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/lib/edid.c
View File

@ -175,12 +175,12 @@ detailed_cvt_descriptor(unsigned char *x, int first)
static char * static char *
extract_string(unsigned char *x, int *valid_termination, int len) extract_string(unsigned char *x, int *valid_termination, int len)
{ {
static char ret[128]; static char ret[EDID_ASCII_STRING_LENGTH + 1];
int i, seen_newline = 0; int i, seen_newline = 0;
memset(ret, 0, sizeof(ret)); memset(ret, 0, sizeof(ret));
for (i = 0; i < len; i++) { for (i = 0; i < min(len, EDID_ASCII_STRING_LENGTH); i++) {
if (seen_newline) { if (seen_newline) {
if (x[i] != 0x20) { if (x[i] != 0x20) {
*valid_termination = 0; *valid_termination = 0;
@ -285,7 +285,7 @@ detailed_block(struct edid *result_edid, unsigned char *x, int in_extension,
printk(BIOS_SPEW, "Monitor name: %s\n", printk(BIOS_SPEW, "Monitor name: %s\n",
extract_string(x + 5, extract_string(x + 5,
&c->has_valid_string_termination, &c->has_valid_string_termination,
13)); EDID_ASCII_STRING_LENGTH));
return 1; return 1;
case 0xFD: case 0xFD:
{ {
@ -477,7 +477,8 @@ detailed_block(struct edid *result_edid, unsigned char *x, int in_extension,
case 0xFF: case 0xFF:
printk(BIOS_SPEW, "Serial number: %s\n", printk(BIOS_SPEW, "Serial number: %s\n",
extract_string(x + 5, extract_string(x + 5,
&c->has_valid_string_termination, 13)); &c->has_valid_string_termination,
EDID_ASCII_STRING_LENGTH));
return 1; return 1;
default: default:
printk(BIOS_SPEW, printk(BIOS_SPEW,