drm/vmwgfx: Potential off by one in vmw_view_add()
The vmw_view_cmd_to_type() function returns vmw_view_max (3) on error. It's one element beyond the end of the vmw_view_cotables[] table. My read on this is that it's possible to hit this failure. header->id comes from vmw_cmd_check() and it's a user controlled number between 1040 and 1225 so we can hit that error. But I don't have the hardware to test this code. Fixes: d80efd5c ("drm/vmwgfx: Initial DX support") Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com> Reviewed-by: NThomas Hellstrom <thellstrom@vmware.com> Cc: <stable@vger.kernel.org>
Showing
想要评论请 注册 或 登录