diff options
| author | Torsten Kaiser <just.for.lkml@googlemail.com> | 2012-07-06 12:06:13 -0700 |
|---|---|---|
| committer | Keith Packard <keithp@keithp.com> | 2012-07-06 12:11:42 -0700 |
| commit | 0b3abacb6430e6593c4358420ba457d8149bd32b (patch) | |
| tree | 2988131c434851682ed9bb177f37a1ff725ed72d /hw | |
| parent | 9e4b8b74b008dd72d1da7074bd7ecae677cefd20 (diff) | |
xfree86: EDID Est III parsing can walk off end of array
Using -O3 gcc notes that m could reach beyound the end of the EstIIIModes array,
if the last bits of the 11s byte where set.
Fix this, by extending the array to cover all possible bits from est.
https://bugs.freedesktop.org/show_bug.cgi?id=45623
Signed-off-by: Torsten Kaiser <x11@ariolc.dyndns.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/xfree86/modes/xf86EdidModes.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c index 8aa82d114..47c169c5b 100644 --- a/hw/xfree86/modes/xf86EdidModes.c +++ b/hw/xfree86/modes/xf86EdidModes.c @@ -723,7 +723,13 @@ static const struct { 1920, 1200, 75, 0}, { 1920, 1200, 85, 0}, { 1920, 1440, 60, 0}, { -1920, 1440, 75, 0},}; + 1920, 1440, 75, 0}, + /* fill up last byte */ + { + 0,0,0,0}, { + 0,0,0,0}, { + 0,0,0,0}, { + 0,0,0,0}, }; static DisplayModePtr DDCModesFromEstIII(unsigned char *est) @@ -735,7 +741,8 @@ DDCModesFromEstIII(unsigned char *est) for (j = 7; j > 0; j--) { if (est[i] & (1 << j)) { m = (i * 8) + (7 - j); - modes = xf86ModesAdd(modes, + if (EstIIIModes[m].w) + modes = xf86ModesAdd(modes, FindDMTMode(EstIIIModes[m].w, EstIIIModes[m].h, EstIIIModes[m].r, |