diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2020-03-06 16:08:48 -0600 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2020-03-06 16:08:48 -0600 |
| commit | 2f501bb1802dbbf1467e7999954588da31f635ad (patch) | |
| tree | b2eb776eff40c989a0b1c64fe613e5cfddb6ab51 | |
| parent | 30fe0d07fd7b27d41d9b31a224052cc4e910947a (diff) | |
| parent | 513dc792d6060d5ef572e43852683097a8420f56 (diff) | |
Merge tag 'drm-fixes-2020-03-06-1' of git://anongit.freedesktop.org/drm/drm
Pull vgacon fix from Daniel Vetter:
"One vgacon input check for stable"
* tag 'drm-fixes-2020-03-06-1' of git://anongit.freedesktop.org/drm/drm:
vgacon: Fix a UAF in vgacon_invert_region
| -rw-r--r-- | drivers/video/console/vgacon.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c index de7b8382aba9..998b0de1812f 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -1316,6 +1316,9 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font) static int vgacon_resize(struct vc_data *c, unsigned int width, unsigned int height, unsigned int user) { + if ((width << 1) * height > vga_vram_size) + return -EINVAL; + if (width % 2 || width > screen_info.orig_video_cols || height > (screen_info.orig_video_lines * vga_default_font_height)/ c->vc_font.height) |