diff options
| author | Junjie Cao <junjie.cao@intel.com> | 2025-10-20 21:47:01 +0800 |
|---|---|---|
| committer | Helge Deller <deller@gmx.de> | 2025-10-28 22:59:19 +0100 |
| commit | 18c4ef4e765a798b47980555ed665d78b71aeadf (patch) | |
| tree | e48eced698abe806332e72248fe2402f94465243 /tools/docs/parse-headers.py | |
| parent | 5f566c0ac51cd2474e47da68dbe719d3acf7d999 (diff) | |
fbdev: bitblit: bound-check glyph index in bit_putcs*
bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Diffstat (limited to 'tools/docs/parse-headers.py')
0 files changed, 0 insertions, 0 deletions