Commit 2aa6c5bc authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Dave Airlie

decode: check we don't reach MAX_VIEWPORTS

Fix found thanks to american fuzzy lop.
Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
parent e0e423aa
......@@ -180,10 +180,12 @@ static int vrend_decode_set_viewport_state(struct vrend_decode_ctx *ctx, int len
return EINVAL;
num_viewports = (length - 1) / 6;
if (num_viewports > PIPE_MAX_VIEWPORTS)
start_slot = get_buf_entry(ctx, VIRGL_SET_VIEWPORT_START_SLOT);
if (num_viewports > PIPE_MAX_VIEWPORTS ||
start_slot > (PIPE_MAX_VIEWPORTS - num_viewports))
return EINVAL;
start_slot = get_buf_entry(ctx, VIRGL_SET_VIEWPORT_START_SLOT);
for (v = 0; v < num_viewports; v++) {
for (i = 0; i < 3; i++)
vps[v].scale[i] = uif(get_buf_entry(ctx, VIRGL_SET_VIEWPORT_STATE_SCALE_0(v) + i));
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment