Commit 18c4ef4e authored by Junjie Cao's avatar Junjie Cao Committed by Helge Deller
Browse files

fbdev: bitblit: bound-check glyph index in bit_putcs* 



bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.

This fixes a global out-of-bounds read reported by syzbot.

Reported-by: default avatar <syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2


Tested-by: default avatar <syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com>
Signed-off-by: default avatarJunjie Cao <junjie.cao@intel.com>
Reviewed-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
parent 5f566c0a

drivers/video/fbdev/core/bitblit.c

+12 −4
Original line number Diff line number Diff line
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(struct vc_data *vc, struct fb_info *info, 
				     struct fb_image *image, u8 *buf, u8 *dst)

{

	u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;

	unsigned int charcnt = vc->vc_font.charcount;

	u32 idx = vc->vc_font.width >> 3;

	u8 *src;



	while (cnt--) {

		src = vc->vc_font.data + (scr_readw(s++)&

					  charmask)*cellsize;

		u16 ch = scr_readw(s++) & charmask;



		if (ch >= charcnt)

			ch = 0;

		src = vc->vc_font.data + (unsigned int)ch * cellsize;



		if (attr) {

			update_attr(buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(struct vc_data *vc, 
				       u8 *dst)

{

	u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;

	unsigned int charcnt = vc->vc_font.charcount;

	u32 shift_low = 0, mod = vc->vc_font.width % 8;

	u32 shift_high = 8;

	u32 idx = vc->vc_font.width >> 3;

	u8 *src;



	while (cnt--) {

		src = vc->vc_font.data + (scr_readw(s++)&

					  charmask)*cellsize;

		u16 ch = scr_readw(s++) & charmask;



		if (ch >= charcnt)

			ch = 0;

		src = vc->vc_font.data + (unsigned int)ch * cellsize;



		if (attr) {

			update_attr(buf, src, attr, vc);