drm: plane: Check crtc coordinates against integer overflows in setplane ioctl
authorVille Syrjälä <ville.syrjala@linux.intel.com>
Mon, 19 Dec 2011 22:06:45 +0000 (00:06 +0200)
committerDave Airlie <airlied@redhat.com>
Tue, 20 Dec 2011 10:04:46 +0000 (10:04 +0000)
Help drivers a little by guaranteeing that crtc_x+crtc_w and
crtc_y+crtc_h don't overflow.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/drm_crtc.c

index 1242e12..b98e491 100644 (file)
@@ -1732,6 +1732,18 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
                goto out;
        }
 
+       /* Give drivers some help against integer overflows */
+       if (plane_req->crtc_w > INT_MAX ||
+           plane_req->crtc_x > INT_MAX - (int32_t) plane_req->crtc_w ||
+           plane_req->crtc_h > INT_MAX ||
+           plane_req->crtc_y > INT_MAX - (int32_t) plane_req->crtc_h) {
+               DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n",
+                             plane_req->crtc_w, plane_req->crtc_h,
+                             plane_req->crtc_x, plane_req->crtc_y);
+               ret = -ERANGE;
+               goto out;
+       }
+
        ret = plane->funcs->update_plane(plane, crtc, fb,
                                         plane_req->crtc_x, plane_req->crtc_y,
                                         plane_req->crtc_w, plane_req->crtc_h,