fdo-mirrors/mesa-drm
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/drm.git synced 2026-04-24 18:40:40 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

xf86drm: fix null pointer deref in drmGetBufInfo

Browse source 
If info.count is large, drmMalloc() / alloca() may fail, and the
resulting null pointer is not null checked before dereference.

Issue: https://gitlab.freedesktop.org/mesa/drm/-/issues/62

Reviewed-by: Simon Ser <contact@emersion.fr>
Signed-off-by: Alistair Delva <adelva@google.com>
This commit is contained in:
Alistair Delva 2021-03-02 08:18:06 -08:00
parent 2e67fef5f6
commit 7d6a175990
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
xf86drm.c
View file

@ -1351,7 +1351,12 @@ drm_public drmBufInfoPtr drmGetBufInfo(int fd)
retval = drmMalloc(sizeof(*retval));
retval->count = info.count;
retval->list = drmMalloc(info.count * sizeof(*retval->list));
if (!(retval->list = drmMalloc(info.count * sizeof(*retval->list)))) {
drmFree(retval);
drmFree(info.list);
return NULL;
}
for (i = 0; i < info.count; i++) {
retval->list[i].count = info.list[i].count;
retval->list[i].size = info.list[i].size;