diff options
| author | Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com> | 2019-11-06 14:58:45 -0500 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2019-11-19 10:12:54 -0500 |
| commit | a1acc5d0942c827d38b008f2c06fcb4e03dda76d (patch) | |
| tree | 26551227a2edc1e425f6d429e60ad507ce55a1d4 /drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c | |
| parent | 302169003733f168f9de5c0d677c0cd82d1be107 (diff) | |
drm/amd/display: Fix static analysis bug in validate_bksv
[Why]
static analysis throws the error below
Out-of-bounds read (OVERRUN)
Overrunning array of 5 bytes at byte offset 7 by dereferencing pointer
(uint64_t *)hdcp->auth.msg.hdcp1.bksv.
var n is going to contain r0p and bcaps. if they are non-zero the count
will be wrong
How]
Use memcpy instead to avoid this.
Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c')
| -rw-r--r-- | drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c index 4d11041a8c6f..04845e43df15 100644 --- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c +++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c @@ -27,9 +27,11 @@ static inline enum mod_hdcp_status validate_bksv(struct mod_hdcp *hdcp) { - uint64_t n = *(uint64_t *)hdcp->auth.msg.hdcp1.bksv; + uint64_t n = 0; uint8_t count = 0; + memcpy(&n, hdcp->auth.msg.hdcp1.bksv, sizeof(uint64_t)); + while (n) { count++; n &= (n - 1); |