From 8c8a854d6f43aacfaba49c116c426913bf416419 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 12 Dec 2019 12:11:30 +0300 Subject: [PATCH] drm/i915/bios: fix off by one in parse_generic_dtd() The "num_dtd" variable is the number of elements in the generic_dtd->dtd[] array so the > needs to be >= to prevent reading one element beyond the end of the array. Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") Reviewed-by: Matt Roper Signed-off-by: Dan Carpenter Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20191212091130.zf2g53njf5u24wk6@kili.mountain --- drivers/gpu/drm/i915/display/intel_bios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index bd674fd..54c02de 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -340,7 +340,7 @@ parse_generic_dtd(struct drm_i915_private *dev_priv, num_dtd = (get_blocksize(generic_dtd) - sizeof(struct bdb_generic_dtd)) / generic_dtd->gdtd_size; - if (dev_priv->vbt.panel_type > num_dtd) { + if (dev_priv->vbt.panel_type >= num_dtd) { DRM_ERROR("Panel type %d not found in table of %d DTD's\n", dev_priv->vbt.panel_type, num_dtd); return; -- 2.7.4