Commit fff01b28 authored Aug 23, 2017 by Narender Ankam Committed by Gerrit - the friendly Code Review server Sep 04, 2017

msm: mdss: hdmi: validate HDMI EDID's max number of CEA blocks



No upper-bound validation is performed when reading number of
extended CEA blocks from the untrusted source (EDID). Add a check
to limit the number of CEA extension blocks.

Change-Id: I69f09ed0ad28a4c267cf3e8f7a12efe46f75e244
Signed-off-by: Narender Ankam <nankam@codeaurora.org>

parent fd4fed88

drivers/video/fbdev/msm/mdss_hdmi_edid.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -2322,6 +2322,13 @@ int hdmi_edid_parser(void *input)
		goto bail;
		}

		/* Find out if CEA extension blocks exceeding max limit */
		if (num_of_cea_blocks >= MAX_EDID_BLOCKS) {
		DEV_WARN("%s: HDMI EDID exceeded max CEA blocks limit\n",
		__func__);
		num_of_cea_blocks = MAX_EDID_BLOCKS - 1;
		}

		/* check for valid CEA block */
		if (edid_buf[EDID_BLOCK_SIZE] != 2) {
		DEV_ERR("%s: Invalid CEA block\n", __func__);