From: oreo639 <oreo639@users.noreply.github.com>
To: ml@inbox.vuxu.org
Subject: Re: [PR PATCH] [Updated] igt-gpu-tools: fix buffer overflow
Date: Thu, 06 Oct 2022 21:01:27 +0200 [thread overview]
Message-ID: <20221006190127.qFP3ogjXpDeeG18F_HuF-siqISygvGcTz2N-Rm8-IfM@z> (raw)
In-Reply-To: <gh-mailinglist-notifications-41a7ca26-5023-4802-975b-f1789d68868e-void-packages-39780@inbox.vuxu.org>
[-- Attachment #1: Type: text/plain, Size: 1251 bytes --]
There is an updated pull request by oreo639 against master on the void-packages repository
https://github.com/oreo639/void-packages igt
https://github.com/void-linux/void-packages/pull/39780
igt-gpu-tools: fix buffer overflow
<!-- Uncomment relevant sections and delete options which are not applicable -->
#### Testing the changes
- I tested the changes in this PR: **briefly**
<!--
#### New package
- This new package conforms to the [package requirements](https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#package-requirements): **YES**|**NO**
-->
<!-- Note: If the build is likely to take more than 2 hours, please add ci skip tag as described in
https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#continuous-integration
and test at least one native build and, if supported, at least one cross build.
Ignore this section if this PR is not skipping CI.
-->
<!--
#### Local build testing
- I built this PR locally for my native architecture, (ARCH-LIBC)
- I built this PR locally for these architectures (if supported. mark crossbuilds):
- aarch64-musl
- armv7l
- armv6l-musl
-->
A patch file from https://github.com/void-linux/void-packages/pull/39780.patch is attached
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-igt-39780.patch --]
[-- Type: text/x-diff, Size: 2852 bytes --]
From be423509617d7c54b9d15ac738b5375d3c0650a9 Mon Sep 17 00:00:00 2001
From: oreo639 <oreo6391@gmail.com>
Date: Thu, 6 Oct 2022 11:44:47 -0700
Subject: [PATCH] igt-gpu-tools: fix buffer overflow
---
...t_edid-Allocate-raw-8-bytes-for-VSDB.patch | 42 +++++++++++++++++++
srcpkgs/igt-gpu-tools/template | 2 +-
2 files changed, 43 insertions(+), 1 deletion(-)
create mode 100644 srcpkgs/igt-gpu-tools/patches/igt_edid-Allocate-raw-8-bytes-for-VSDB.patch
diff --git a/srcpkgs/igt-gpu-tools/patches/igt_edid-Allocate-raw-8-bytes-for-VSDB.patch b/srcpkgs/igt-gpu-tools/patches/igt_edid-Allocate-raw-8-bytes-for-VSDB.patch
new file mode 100644
index 000000000000..7cc9e289305c
--- /dev/null
+++ b/srcpkgs/igt-gpu-tools/patches/igt_edid-Allocate-raw-8-bytes-for-VSDB.patch
@@ -0,0 +1,42 @@
+From 2107b0a53692fb329175bc16169c3699712187aa Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 27 Feb 2021 14:10:41 -0800
+Subject: [PATCH] lib/igt_edid: Allocate raw 8-bytes for VSDB
+
+hdmi_vsdb is an element of cea_vsdb which makes the size of cea_vsdb to
+be 8 ( 3bytes ieee_oui ) + ( 5bytes hdmi_vsdb struct), its true that we
+only use 7 bytes technically we can only allocate 7byte array but since
+we are writing to elements of hdmi_vsdb struct which is sitting at offet
+4-8 in cea_vsdb, compiler thinks we have an element which is out of
+array bounds since out allocated size is 7bytes
+
+This errors out
+../git/lib/igt_edid.c:365:13: error: array subscript 'struct hdmi_vsdb[0]' is partly outside array bounds of 'char[7]' [-Werror=array-bounds]
+ 365 | hdmi->src_phy_addr[0] = 0x10;
+ | ^~
+
+allocating one extra byte matches with size of cea_vsdb and compiler is
+happy
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Reviewed-by: Martin Peres <martin.peres@mupuf.org>
+---
+ lib/igt_edid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/igt_edid.c b/lib/igt_edid.c
+index 1c85486d..ce09cc47 100644
+--- a/lib/igt_edid.c
++++ b/lib/igt_edid.c
+@@ -351,7 +351,7 @@ void cea_sad_init_pcm(struct cea_sad *sad, int channels,
+ const struct cea_vsdb *cea_vsdb_get_hdmi_default(size_t *size)
+ {
+ /* We'll generate a VSDB with 2 extension fields. */
+- static char raw[CEA_VSDB_HDMI_MIN_SIZE + 2] = {0};
++ static char raw[CEA_VSDB_HDMI_MIN_SIZE + 3] = {0};
+ struct cea_vsdb *vsdb;
+ struct hdmi_vsdb *hdmi;
+
+--
+GitLab
+
diff --git a/srcpkgs/igt-gpu-tools/template b/srcpkgs/igt-gpu-tools/template
index e5865e11a57f..02f6cc4bba66 100644
--- a/srcpkgs/igt-gpu-tools/template
+++ b/srcpkgs/igt-gpu-tools/template
@@ -1,7 +1,7 @@
# Template file for 'igt-gpu-tools'
pkgname=igt-gpu-tools
version=1.25
-revision=5
+revision=6
build_style=meson
configure_args="-Db_ndebug=false -Db_lto=false"
# b_lto=true makes the build hang at a random point
next prev parent reply other threads:[~2022-10-06 19:01 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-06 18:24 [PR PATCH] igt-gpu-tools: update to 1.26 oreo639
2022-10-06 18:27 ` [PR PATCH] [Updated] " oreo639
2022-10-06 18:44 ` oreo639
2022-10-06 19:00 ` igt-gpu-tools: fix buffer overflow paper42
2022-10-06 19:01 ` oreo639 [this message]
2022-10-06 19:13 ` [PR PATCH] [Merged]: " paper42
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221006190127.qFP3ogjXpDeeG18F_HuF-siqISygvGcTz2N-Rm8-IfM@z \
--to=oreo639@users.noreply.github.com \
--cc=ml@inbox.vuxu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).