apfs/linux-apfs
0
0
Fork 0
mirror of https://github.com/linux-apfs/linux-apfs.git synced 2026-05-01 15:00:59 -07:00
Code Issues Packages Projects Releases Wiki Activity

vt: Fix a read-past-array in vc_t416_color().

Browse Source 
This makes it show up on UBSAN:
perl -e 'for (0..15) {my @x=("0")x$_;push @x,qw(38 2 64 128 192 4);printf
"\e[%smAfter %d zeroes.\e[0m\n", join(";",@x[0..($_+5<15?$_+5:15)]), $_}'

Seems harmless: if you can programmatically read attributes of a vt
character (/dev/vcsa*), multiple probes can obtain parts of vt_mode then
lowest byte (5th on 64-bit big-endian) of a pointer.

Signed-off-by: Adam Borowski <kilobyte@angband.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Adam Borowski
2016-09-15 16:47:09 +02:00
committed by Greg Kroah-Hartman
parent d2ec3f77de
commit 669e0a51b1
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/tty/vt/vt.c
+1 -1
View File
@@ -1316,7 +1316,7 @@ static int vc_t416_color(struct vc_data *vc, int i,
/* 256 colours -- ubiquitous */
i++;
rgb_from_256(vc->vc_par[i], &c);
} else if (vc->vc_par[i] == 2 && i <= vc->vc_npar + 3) {
} else if (vc->vc_par[i] == 2 && i + 3 <= vc->vc_npar) {
/* 24 bit -- extremely rare */
c.r = vc->vc_par[i + 1];
c.g = vc->vc_par[i + 2];