Aurelien
/
xf86-video-intel
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

display: Check for buffer overrun in output name lookup. 

The kernel may know about more types than we do, so protect ourselves
from reading from beyond the end of the string array.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
This commit is contained in:
Chris Wilson 2010-08-04 09:46:01 +01:00
parent 5662916691
commit 2b7263b771
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/intel_display.c
View File

@ -1250,6 +1250,7 @@ intel_output_init(ScrnInfoPtr scrn, struct intel_mode *mode, int num)
drmModeConnectorPtr koutput;
drmModeEncoderPtr kencoder;
struct intel_output *intel_output;
const char *output_name;
char name[32];
koutput = drmModeGetConnector(mode->fd,
@ -1263,8 +1264,11 @@ intel_output_init(ScrnInfoPtr scrn, struct intel_mode *mode, int num)
return;
}
snprintf(name, 32, "%s%d", output_names[koutput->connector_type],
koutput->connector_type_id);
if (koutput->connector_type < ARRAY_SIZE(output_names))
output_name = output_names[koutput->connector_type];
else
output_name = "UNKNOWN";
snprintf(name, 32, "%s%d", output_name, koutput->connector_type_id);
output = xf86OutputCreate (scrn, &intel_output_funcs, name);
if (!output) {