Commit 020db416 authored by Jeffrey Lee's avatar Jeffrey Lee
Browse files

Avoid potential read of bad address in CEA block processing

Detail:
  c/ScrModes - Reorder while loop conditions to ensure the DTD offset is checked before we try reading any data; prevents potential data abort if initial offset is too large to be valid.
Admin:
  Builds, untested


Version 0.47. Retagged as 'ScrModes-0_47'
parent d4ee2737
...@@ -2516,8 +2516,8 @@ static _kernel_oserror *process_cea_extension_type_3(EDIDExtensionBlockRef ext_b ...@@ -2516,8 +2516,8 @@ static _kernel_oserror *process_cea_extension_type_3(EDIDExtensionBlockRef ext_b
return NULL; return NULL;
} }
while ((extdata[dtd_offset] != 0) && (extdata[dtd_offset+1] != 0) && while ((dtd_offset < (128 - 18)) &&
(dtd_offset < (128 - 18))) (extdata[dtd_offset] != 0) && (extdata[dtd_offset+1] != 0))
{ {
ModeDescriptionRef mp; ModeDescriptionRef mp;
mp = (ModeDescriptionRef) malloc (sizeof(ModeDescription)); mp = (ModeDescriptionRef) malloc (sizeof(ModeDescription));
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment