andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

xfree86: EDID Est III parsing can walk off end of array

Browse Source 
Using -O3 gcc notes that m could reach beyound the end of the EstIIIModes array,
if the last bits of the 11s byte where set.
Fix this, by extending the array to cover all possible bits from est.

https://bugs.freedesktop.org/show_bug.cgi?id=45623

Signed-off-by: Torsten Kaiser <x11@ariolc.dyndns.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
Torsten Kaiser 2012-07-06 12:06:13 -07:00 committed by Keith Packard
parent 9e4b8b74b0
commit 0b3abacb64
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hw/xfree86/modes/xf86EdidModes.c
View File

@ -723,7 +723,13 @@ static const struct {
1920, 1200, 75, 0}, {
1920, 1200, 85, 0}, {
1920, 1440, 60, 0}, {
1920, 1440, 75, 0},};
1920, 1440, 75, 0},
/* fill up last byte */
{
0,0,0,0}, {
0,0,0,0}, {
0,0,0,0}, {
0,0,0,0}, };
static DisplayModePtr
DDCModesFromEstIII(unsigned char *est)
@ -735,7 +741,8 @@ DDCModesFromEstIII(unsigned char *est)
for (j = 7; j > 0; j--) {
if (est[i] & (1 << j)) {
m = (i * 8) + (7 - j);
modes = xf86ModesAdd(modes,
if (EstIIIModes[m].w)
modes = xf86ModesAdd(modes,
FindDMTMode(EstIIIModes[m].w,
EstIIIModes[m].h,
EstIIIModes[m].r,