Zhang Shurong 2e56d380da fbdev: fix potential OOB read in fast_imageblit() ...

[ Upstream commit c2d22806ae ]

There is a potential OOB read at fast_imageblit, for
"colortab[(*src >> 4)]" can become a negative value due to
"const char *s = image->data, *src".
This change makes sure the index for colortab always positive
or zero.

Similar commit:
https://patchwork.kernel.org/patch/11746067

Potential bug report:
https://groups.google.com/g/syzkaller-bugs/c/9ubBXKeKXf4/m/k-QXy4UgAAAJ

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-08-30 16:18:12 +02:00

..

bitblit.c

…

cfbcopyarea.c

…

cfbfillrect.c

…

cfbimgblt.c

…

fb_cmdline.c

…

fb_ddc.c

…

fb_defio.c

…

fb_draw.h

…

fb_notify.c

…

fb_sys_fops.c

…

fbcmap.c

…

fbcon_ccw.c

…

fbcon_cw.c

…

fbcon_rotate.c

…

fbcon_rotate.h

…

fbcon_ud.c

…

fbcon.c

…

fbcon.h

…

fbcvt.c

…

fbmem.c

…

fbmon.c

…

fbsysfs.c

…

Makefile

…

modedb.c

…

softcursor.c

…

svgalib.c

…

syscopyarea.c

…

sysfillrect.c

…

sysimgblt.c

fbdev: fix potential OOB read in fast_imageblit()

2023-08-30 16:18:12 +02:00

tileblit.c

…