Re: [PATCH] fbdev: udlfb: validate vendor descriptor items
From: Helge Deller <deller@gmx.de>
Date: 2026-07-18 18:26:16
Also in:
dri-devel, lkml
On 7/6/26 11:30, Pengpeng Hou wrote:
quoted hunk ↗ jump to hunk
dlfb_parse_vendor_descriptor() walks key-length-value items inside the DisplayLink vendor descriptor. Require each item to contain its key, length and declared value bytes before reading item-specific fields such as max_area. Signed-off-by: Pengpeng Hou <redacted> --- drivers/video/fbdev/udlfb.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c index fdbb8671a810..e78d6f95c9c5 100644 --- a/drivers/video/fbdev/udlfb.c +++ b/drivers/video/fbdev/udlfb.c@@ -1586,19 +1586,29 @@ static int dlfb_parse_vendor_descriptor(struct dlfb_data *dlfb, desc += 5; /* the fixed header we've already parsed */ while (desc < desc_end) { + char *value; u8 length; u16 key; - key = *desc++; - key |= (u16)*desc++ << 8; + if (desc_end - desc < sizeof(key) + sizeof(length)) + goto unrecognized; + + key = get_unaligned_le16(desc);
Is there a reason why you switch to unconditional little-endian reads? Is this "vendor descriptor" always little-endian? If yes, then your patch is probably correct. If not, I think your patch will most likely break big-endian machines. Helge
quoted hunk ↗ jump to hunk
+ desc += sizeof(key); length = *desc++; + if (length > desc_end - desc) + goto unrecognized; + + value = desc; switch (key) { case 0x0200: { /* max_area */ - u32 max_area = *desc++; - max_area |= (u32)*desc++ << 8; - max_area |= (u32)*desc++ << 16; - max_area |= (u32)*desc++ << 24; + u32 max_area; + + if (length < sizeof(max_area)) + goto unrecognized; + + max_area = get_unaligned_le32(value); dev_warn(&intf->dev, "DL chip limited to %d pixel modes\n", max_area);