Junjie Cao 901f442270 fbdev: bitblit: bound-check glyph index in bit_putcs* ...

commit 18c4ef4e76 upstream.

bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.

This fixes a global out-of-bounds read reported by syzbot.

Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-11-13 15:33:55 -05:00

..

bitblit.c

fbdev: bitblit: bound-check glyph index in bit_putcs*

2025-11-13 15:33:55 -05:00

cfbcopyarea.c

…

cfbfillrect.c

…

cfbimgblt.c

…

fb_backlight.c

…

fb_chrdev.c

…

fb_cmdline.c

fbdev: Fix logic error in "offb" name match

2025-10-19 16:33:49 +02:00

fb_ddc.c

…

fb_defio.c

…

fb_draw.h

…

fb_info.c

…

fb_internal.h

…

fb_io_fops.c

…

fb_logo.c

…

fb_notify.c

…

fb_procfs.c

…

fb_sys_fops.c

…

fbcmap.c

…

fbcon_ccw.c

…

fbcon_cw.c

…

fbcon_rotate.c

…

fbcon_rotate.h

…

fbcon_ud.c

…

fbcon.c

fbcon: Set fb_display[i]->mode to NULL when the mode is released

2025-11-13 15:33:55 -05:00

fbcon.h

…

fbcvt.c

…

fbmem.c

fbcon: Set fb_display[i]->mode to NULL when the mode is released

2025-11-13 15:33:55 -05:00

fbmon.c

…

fbsysfs.c

…

Kconfig

…

Makefile

…

modedb.c

…

softcursor.c

…

svgalib.c

…

syscopyarea.c

…

sysfillrect.c

…

sysimgblt.c

…

tileblit.c

…