drm/i915/gvt/fb_decoder: Fix out-of-bounds read
authorGustavo A. R. Silva <garsilva@embeddedor.com>
Sat, 9 Dec 2017 06:37:59 +0000 (00:37 -0600)
committerZhenyu Wang <zhenyuw@linux.intel.com>
Mon, 11 Dec 2017 09:18:39 +0000 (17:18 +0800)
commit461bd6227ede277138bf33c2156b6ebd1fba04c2
tree9b376b6f8f31057a37e47d5a47d76272dfe010ad
parenteb3f05171c2e84f0114403df0fea942479fdaa3e
drm/i915/gvt/fb_decoder: Fix out-of-bounds read

In case function skl_format_to_drm returns -EINVAL, fmt turns into a huge
number as fmt is of type u32, hence there is an out-of-bounds read when
using fmt as an index for array skl_pixel_formats at line 225:
plane->bpp = skl_pixel_formats[fmt].bpp;

Fix this by comparing the value returned by function skl_format_to_drm
against the size of array skl_pixel_formats, so in case it is greater than
or equal to the number of items contained in skl_pixel_formats, print an
error message and return -EINVAL.

Addresses-Coverity-ID: 1462495
Addresses-Coverity-ID: 1462502 ("Out-of-bounds read")
Fixes: 9f31d1063b43 ("drm/i915/gvt: Add framebuffer decoder support")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
drivers/gpu/drm/i915/gvt/fb_decoder.c