From: jsg <jsg@openbsd.org>
Date: Fri, 11 Oct 2024 02:29:43 +0000 (+0000)
Subject: drm/amd/display: Fix index out of bounds in DCN30 color transformation
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=42159b50e6866dc8793dacce6e28cf244be8190b;p=openbsd

drm/amd/display: Fix index out of bounds in DCN30 color transformation

From Srinivasan Shanmugam
929506d5671419cffd8d01e9a7f5eae53682a838 in linux-6.6.y/6.6.55
d81873f9e715b72d4f8d391c8eb243946f784dfc in mainline linux
---

diff --git a/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_cm_common.c b/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_cm_common.c
index e0b1fc92ed1..62c02adae7e 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_cm_common.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_cm_common.c
@@ -178,6 +178,8 @@ bool cm3_helper_translate_curve_to_hw_format(
 				i += increment) {
 			if (j == hw_points - 1)
 				break;
+			if (i >= TRANSFER_FUNC_POINTS)
+				return false;
 			rgb_resulted[j].red = output_tf->tf_pts.red[i];
 			rgb_resulted[j].green = output_tf->tf_pts.green[i];
 			rgb_resulted[j].blue = output_tf->tf_pts.blue[i];