aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTetsuo Handa <[email protected]>2020-08-31 19:37:00 +0900
committerGreg Kroah-Hartman <[email protected]>2020-09-04 17:27:10 +0200
commitbd018a6a75cebb511bb55a0e7690024be975fe93 (patch)
treee9081c7d9452a291f4076e501c189736410c949a
parent42f07816ac0cc797928119cc039c414ae2b95d34 (diff)
video: fbdev: fix OOB read in vga_8planes_imageblit()
syzbot is reporting OOB read at vga_8planes_imageblit() [1], for "cdat[y] >> 4" can become a negative value due to "const char *cdat". [1] https://syzkaller.appspot.com/bug?id=0d7a0da1557dcd1989e00cb3692b26d4173b4132 Reported-by: syzbot <[email protected]> Signed-off-by: Tetsuo Handa <[email protected]> Cc: stable <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
-rw-r--r--drivers/video/fbdev/vga16fb.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c
index a20eeb8308ff..578d3541e3d6 100644
--- a/drivers/video/fbdev/vga16fb.c
+++ b/drivers/video/fbdev/vga16fb.c
@@ -1121,7 +1121,7 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i
char oldop = setop(0);
char oldsr = setsr(0);
char oldmask = selectmask();
- const char *cdat = image->data;
+ const unsigned char *cdat = image->data;
u32 dx = image->dx;
char __iomem *where;
int y;