NVIDIA/open-gpu-kernel-modules
1
0
Fork 0
mirror of https://github.com/NVIDIA/open-gpu-kernel-modules.git synced 2026-02-02 22:47:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

525.105.17

Browse Source
This commit is contained in:
Andy Ritger
2023-03-30 10:16:11 -07:00
parent e598191e8e
commit ebcc6656ff
100 changed files with 2912 additions and 1117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/common/modeset/timing/nvt_edid.c
View File

@@ -2098,8 +2098,8 @@ NvU32 NvTiming_EDIDValidationMask(NvU8 *pEdid, NvU32 length, NvBool bIsStrongVal
// validate DTD blocks
pDTD = (DETAILEDTIMINGDESCRIPTOR *)&pExt[((EIA861EXTENSION *)pExt)->offset];
while (pDTD->wDTPixelClock != 0 &&
(NvU8 *)pDTD - pExt < (int)sizeof(EIA861EXTENSION))
while ((pDTD->wDTPixelClock != 0) &&
(((NvU8 *)pDTD - pExt + sizeof(DETAILEDTIMINGDESCRIPTOR)) < ((NvU8)sizeof(EIA861EXTENSION) - 1)))
{
if (parseEdidDetailedTimingDescriptor((NvU8 *)pDTD, NULL) != NVT_STATUS_SUCCESS)
{
@@ -2342,8 +2342,8 @@ NvU32 NvTiming_EDIDStrongValidationMask(NvU8 *pEdid, NvU32 length)
// validate DTD blocks
pDTD = (DETAILEDTIMINGDESCRIPTOR *)&pExt[((EIA861EXTENSION *)pExt)->offset];
while (pDTD->wDTPixelClock != 0 &&
(NvU8 *)pDTD - pExt < (int)sizeof(EIA861EXTENSION))
while ((pDTD->wDTPixelClock != 0) &&
(((NvU8 *)pDTD - pExt + sizeof(DETAILEDTIMINGDESCRIPTOR)) < ((NvU8)sizeof(EIA861EXTENSION) -1)))
{
if (parseEdidDetailedTimingDescriptor((NvU8 *)pDTD, NULL) != NVT_STATUS_SUCCESS)
ret |= NVT_EDID_VALIDATION_ERR_MASK(NVT_EDID_VALIDATION_ERR_EXT_DTD);

13
src/common/modeset/timing/nvt_edidext_861.c
View File

@@ -397,7 +397,7 @@ void parse861ExtDetailedTiming(NvU8 *pEdidExt,
// Get all detailed timings in CEA ext block
pDTD = (DETAILEDTIMINGDESCRIPTOR *)&pEdidExt[pEIA861->offset];
while((NvU8 *)pDTD < (pEdidExt + sizeof(EDIDV1STRUC)) && // Check that we're not going beyond this extension block.
while((NvU8 *)pDTD + sizeof(DETAILEDTIMINGDESCRIPTOR) < (pEdidExt + sizeof(EDIDV1STRUC) - 1) &&
pDTD->wDTPixelClock != 0)
{
NVMISC_MEMSET(&newTiming, 0, sizeof(newTiming));
@@ -1237,6 +1237,12 @@ NVT_STATUS get861ExtInfo(NvU8 *p, NvU32 size, NVT_EDID_CEA861_INFO *p861info)
return NVT_STATUS_ERR;
}
// DTD offset sanity check
if (p[2] >= 1 && p[2] <= 3)
{
return NVT_STATUS_ERR;
}
// don't do anything further if p861info is NULL
if (p861info == NULL)
{
@@ -1299,6 +1305,11 @@ NVT_STATUS parseCta861DataBlockInfo(NvU8 *p,
tag = NVT_CEA861_GET_SHORT_DESCRIPTOR_TAG(p[i]);
payload = NVT_CEA861_GET_SHORT_DESCRIPTOR_SIZE(p[i]);
/*don't allow data colleciton totally size larger than [127 - 5 (tag, revision, offset, describing native video format, checksum)]*/
if ((i + payload > size) || (i + payload > 122))
{
return NVT_STATUS_ERR;
}
// move the pointer to the payload section or extended Tag Code
i++;