From d840e2b3f019cd37920d6a2ca3c4cfd6f5432699 Mon Sep 17 00:00:00 2001 From: Patrick Georgi Date: Tue, 18 Sep 2018 18:01:02 +0200 Subject: src/lib/edid: avoid buffer overflow It's more theoretical, but lest somebody calls extract_string() with too large a length... Change-Id: I3934bd6965318cdffe5c636b01b3e0c4426e8d1d Signed-off-by: Patrick Georgi Found-by: Coverity Scan #1374795 Reviewed-on: https://review.coreboot.org/28659 Reviewed-by: Paul Menzel Reviewed-by: Angel Pons Tested-by: build bot (Jenkins) --- src/lib/edid.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'src/lib') diff --git a/src/lib/edid.c b/src/lib/edid.c index fbd8ef65f5..957897ef52 100644 --- a/src/lib/edid.c +++ b/src/lib/edid.c @@ -175,12 +175,12 @@ detailed_cvt_descriptor(unsigned char *x, int first) static char * extract_string(unsigned char *x, int *valid_termination, int len) { - static char ret[128]; + static char ret[EDID_ASCII_STRING_LENGTH + 1]; int i, seen_newline = 0; memset(ret, 0, sizeof(ret)); - for (i = 0; i < len; i++) { + for (i = 0; i < min(len, EDID_ASCII_STRING_LENGTH); i++) { if (seen_newline) { if (x[i] != 0x20) { *valid_termination = 0; @@ -285,7 +285,7 @@ detailed_block(struct edid *result_edid, unsigned char *x, int in_extension, printk(BIOS_SPEW, "Monitor name: %s\n", extract_string(x + 5, &c->has_valid_string_termination, - 13)); + EDID_ASCII_STRING_LENGTH)); return 1; case 0xFD: { @@ -477,7 +477,8 @@ detailed_block(struct edid *result_edid, unsigned char *x, int in_extension, case 0xFF: printk(BIOS_SPEW, "Serial number: %s\n", extract_string(x + 5, - &c->has_valid_string_termination, 13)); + &c->has_valid_string_termination, + EDID_ASCII_STRING_LENGTH)); return 1; default: printk(BIOS_SPEW, -- cgit v1.2.3