From b248f068ebff00ac75d74cb34b3fe9e08a48ce3e Mon Sep 17 00:00:00 2001 From: jsg Date: Sat, 15 Jun 2024 04:07:53 +0000 Subject: [PATCH] drm/amd/display: Fix potential index out of bounds in color transformation function From Srinivasan Shanmugam 4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86 in linux-6.6.y/6.6.33 63ae548f1054a0b71678d0349c7dc9628ddd42ca in mainline linux --- sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_cm_common.c index 3538973bd0c..c0372aa4ec8 100644 --- a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_cm_common.c +++ b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_cm_common.c @@ -382,6 +382,11 @@ bool cm_helper_translate_curve_to_hw_format(struct dc_context *ctx, i += increment) { if (j == hw_points - 1) break; + if (i >= TRANSFER_FUNC_POINTS) { + DC_LOG_ERROR("Index out of bounds: i=%d, TRANSFER_FUNC_POINTS=%d\n", + i, TRANSFER_FUNC_POINTS); + return false; + } rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i]; -- 2.20.1