Skip to content

Commit 59d99de

Browse files
Alex Hungalexdeucher
authored andcommitted
drm/amd/display: Check index msg_id before read or write
[WHAT] msg_id is used as an array index and it cannot be a negative value, and therefore cannot be equal to MOD_HDCP_MESSAGE_ID_INVALID (-1). [HOW] Check whether msg_id is valid before reading and setting. This fixes 4 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <[email protected]> Acked-by: Wayne Lin <[email protected]> Signed-off-by: Alex Hung <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
1 parent acce647 commit 59d99de

File tree

1 file changed

+8
-0
lines changed
  • drivers/gpu/drm/amd/display/modules/hdcp

1 file changed

+8
-0
lines changed

drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,10 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp,
156156
uint32_t cur_size = 0;
157157
uint32_t data_offset = 0;
158158

159+
if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {
160+
return MOD_HDCP_STATUS_DDC_FAILURE;
161+
}
162+
159163
if (is_dp_hdcp(hdcp)) {
160164
while (buf_len > 0) {
161165
cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);
@@ -215,6 +219,10 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp,
215219
uint32_t cur_size = 0;
216220
uint32_t data_offset = 0;
217221

222+
if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {
223+
return MOD_HDCP_STATUS_DDC_FAILURE;
224+
}
225+
218226
if (is_dp_hdcp(hdcp)) {
219227
while (buf_len > 0) {
220228
cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);

0 commit comments

Comments
 (0)