[PATCH v2] video/logo: protect against divide by zero when reading image
From: Yiyuan GUO <hidden>
Date: 2021-05-14 07:32:51
Also in:
dri-devel
Subsystem:
framebuffer layer, the rest · Maintainers:
Helge Deller, Linus Torvalds
In video/logo/pnmtologo.c, the function read_image can read from the image file an integer 0 and pass it to function get_number255, leading to a divide by zero problem. Signed-off-by: Yiyuan GUO <redacted> --- drivers/video/logo/pnmtologo.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/video/logo/pnmtologo.c b/drivers/video/logo/pnmtologo.c
index 4718d7895..d9e8d1d5b 100644
--- a/drivers/video/logo/pnmtologo.c
+++ b/drivers/video/logo/pnmtologo.c@@ -116,6 +116,16 @@ static unsigned int get_number(FILE *fp) return val; } +static unsigned int get_maxval(FILE *fp) +{ + unsigned int maxval = get_number(fp); + + if (!maxval) + die("%s: invalid maxval zero\n", filename); + + return maxval; +} + static unsigned int get_number255(FILE *fp, unsigned int maxval) { unsigned int val = get_number(fp);
@@ -182,7 +192,7 @@ static void read_image(void) case '2': /* Plain PGM */ - maxval = get_number(fp); + maxval = get_maxval(fp); for (i = 0; i < logo_height; i++) for (j = 0; j < logo_width; j++) logo_data[i][j].red = logo_data[i][j].green =
@@ -191,7 +201,7 @@ static void read_image(void) case '3': /* Plain PPM */ - maxval = get_number(fp); + maxval = get_maxval(fp); for (i = 0; i < logo_height; i++) for (j = 0; j < logo_width; j++) { logo_data[i][j].red = get_number255(fp, maxval);
--
2.25.1