staging: xgifb: validate the mode against video memory size
authorAaro Koskinen <aaro.koskinen@iki.fi>
Tue, 11 Sep 2012 21:44:37 +0000 (00:44 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 12 Sep 2012 16:45:58 +0000 (09:45 -0700)
It's possible to select video mode that exceeds the available video
memory. This is potentially dangerous, fix by adding a check.

The patch fixes system hangs seen occasionally when playing random videos
with mplayer.

Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/xgifb/XGI_main_26.c

index 7fc3049a709c97fddac1219e073af97b37037db6..ba6c3475a51739b03bdf7c4edc85e6cade9065c2 100644 (file)
@@ -329,6 +329,7 @@ static int XGIfb_validate_mode(struct xgifb_video_info *xgifb_info, int myindex)
 {
        u16 xres, yres;
        struct xgi_hw_device_info *hw_info = &xgifb_info->hw_info;
+       unsigned long required_mem;
 
        if (xgifb_info->chip == XG21) {
                if (xgifb_info->display2 == XGIFB_DISP_LCD) {
@@ -345,13 +346,13 @@ static int XGIfb_validate_mode(struct xgifb_video_info *xgifb_info, int myindex)
                        }
 
                }
-               return myindex;
+               goto check_memory;
 
        }
 
        /* FIXME: for now, all is valid on XG27 */
        if (xgifb_info->chip == XG27)
-               return myindex;
+               goto check_memory;
 
        if (!(XGIbios_mode[myindex].chipset & MD_XGI315))
                return -1;
@@ -539,6 +540,12 @@ static int XGIfb_validate_mode(struct xgifb_video_info *xgifb_info, int myindex)
        case XGIFB_DISP_NONE:
                break;
        }
+
+check_memory:
+       required_mem = XGIbios_mode[myindex].xres * XGIbios_mode[myindex].yres *
+                      XGIbios_mode[myindex].bpp / 8;
+       if (required_mem > xgifb_info->video_size)
+               return -1;
        return myindex;
 
 }