* [PATCH libdrm] intel: avoid null pointer dereference
@ 2017-02-02 22:57 Thomas Hindoe Paaboel Andersen
2017-02-03 10:57 ` Eric Engestrom
0 siblings, 1 reply; 4+ messages in thread
From: Thomas Hindoe Paaboel Andersen @ 2017-02-02 22:57 UTC (permalink / raw)
To: dri-devel; +Cc: Thomas Hindoe Paaboel Andersen
Introduced in 028715ee
Move the dereference after the null check.
---
intel/intel_decode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/intel/intel_decode.c b/intel/intel_decode.c
index 803d202..2721ffd 100644
--- a/intel/intel_decode.c
+++ b/intel/intel_decode.c
@@ -3899,7 +3899,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
int ret;
unsigned int index = 0;
uint32_t devid;
- int size = ctx->base_count * 4;
+ int size;
void *temp;
if (!ctx)
@@ -3909,6 +3909,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
* the batchbuffer. This lets us avoid a bunch of length
* checking in statically sized packets.
*/
+ size = ctx->base_count * 4;
temp = malloc(size + 4096);
memcpy(temp, ctx->base_data, size);
memset((char *)temp + size, 0xd0, 4096);
--
2.9.3
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH libdrm] intel: avoid null pointer dereference
2017-02-02 22:57 [PATCH libdrm] intel: avoid null pointer dereference Thomas Hindoe Paaboel Andersen
@ 2017-02-03 10:57 ` Eric Engestrom
2017-02-07 14:59 ` Thomas H.P. Andersen
0 siblings, 1 reply; 4+ messages in thread
From: Eric Engestrom @ 2017-02-03 10:57 UTC (permalink / raw)
To: Thomas Hindoe Paaboel Andersen; +Cc: dri-devel
On Thursday, 2017-02-02 23:57:29 +0100, Thomas Hindoe Paaboel Andersen wrote:
> Introduced in 028715ee
>
> Move the dereference after the null check.
Fixes: 028715ee707469189505 ("intel: Avoid the need for most overflow
checks by using a scratch page.")
Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
> ---
> intel/intel_decode.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/intel/intel_decode.c b/intel/intel_decode.c
> index 803d202..2721ffd 100644
> --- a/intel/intel_decode.c
> +++ b/intel/intel_decode.c
> @@ -3899,7 +3899,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> int ret;
> unsigned int index = 0;
> uint32_t devid;
> - int size = ctx->base_count * 4;
> + int size;
> void *temp;
>
> if (!ctx)
> @@ -3909,6 +3909,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> * the batchbuffer. This lets us avoid a bunch of length
> * checking in statically sized packets.
> */
> + size = ctx->base_count * 4;
> temp = malloc(size + 4096);
> memcpy(temp, ctx->base_data, size);
> memset((char *)temp + size, 0xd0, 4096);
> --
> 2.9.3
>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH libdrm] intel: avoid null pointer dereference
2017-02-03 10:57 ` Eric Engestrom
@ 2017-02-07 14:59 ` Thomas H.P. Andersen
2017-02-07 15:14 ` Eric Engestrom
0 siblings, 1 reply; 4+ messages in thread
From: Thomas H.P. Andersen @ 2017-02-07 14:59 UTC (permalink / raw)
To: Eric Engestrom; +Cc: dri-devel
On Fri, Feb 3, 2017 at 11:57 AM, Eric Engestrom
<eric.engestrom@imgtec.com> wrote:
>
> On Thursday, 2017-02-02 23:57:29 +0100, Thomas Hindoe Paaboel Andersen wrote:
> > Introduced in 028715ee
> >
> > Move the dereference after the null check.
>
> Fixes: 028715ee707469189505 ("intel: Avoid the need for most overflow
> checks by using a scratch page.")
> Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
Thanks. I do not have commit access. Can I ask you to push it?
>
> > ---
> > intel/intel_decode.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/intel/intel_decode.c b/intel/intel_decode.c
> > index 803d202..2721ffd 100644
> > --- a/intel/intel_decode.c
> > +++ b/intel/intel_decode.c
> > @@ -3899,7 +3899,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> > int ret;
> > unsigned int index = 0;
> > uint32_t devid;
> > - int size = ctx->base_count * 4;
> > + int size;
> > void *temp;
> >
> > if (!ctx)
> > @@ -3909,6 +3909,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> > * the batchbuffer. This lets us avoid a bunch of length
> > * checking in statically sized packets.
> > */
> > + size = ctx->base_count * 4;
> > temp = malloc(size + 4096);
> > memcpy(temp, ctx->base_data, size);
> > memset((char *)temp + size, 0xd0, 4096);
> > --
> > 2.9.3
> >
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH libdrm] intel: avoid null pointer dereference
2017-02-07 14:59 ` Thomas H.P. Andersen
@ 2017-02-07 15:14 ` Eric Engestrom
0 siblings, 0 replies; 4+ messages in thread
From: Eric Engestrom @ 2017-02-07 15:14 UTC (permalink / raw)
To: Thomas H.P. Andersen, Emil Velikov; +Cc: dri-devel
On Tuesday, 2017-02-07 15:59:32 +0100, Thomas H.P. Andersen wrote:
> On Fri, Feb 3, 2017 at 11:57 AM, Eric Engestrom
> <eric.engestrom@imgtec.com> wrote:
> >
> > On Thursday, 2017-02-02 23:57:29 +0100, Thomas Hindoe Paaboel Andersen wrote:
> > > Introduced in 028715ee
> > >
> > > Move the dereference after the null check.
> >
> > Fixes: 028715ee707469189505 ("intel: Avoid the need for most overflow
> > checks by using a scratch page.")
> > Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
>
> Thanks. I do not have commit access. Can I ask you to push it?
I actually don't have commit access to libdrm either :)
Emil, can you push this (and the autogen patches)?
Cheers,
Eric
>
> >
> > > ---
> > > intel/intel_decode.c | 3 ++-
> > > 1 file changed, 2 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/intel/intel_decode.c b/intel/intel_decode.c
> > > index 803d202..2721ffd 100644
> > > --- a/intel/intel_decode.c
> > > +++ b/intel/intel_decode.c
> > > @@ -3899,7 +3899,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> > > int ret;
> > > unsigned int index = 0;
> > > uint32_t devid;
> > > - int size = ctx->base_count * 4;
> > > + int size;
> > > void *temp;
> > >
> > > if (!ctx)
> > > @@ -3909,6 +3909,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> > > * the batchbuffer. This lets us avoid a bunch of length
> > > * checking in statically sized packets.
> > > */
> > > + size = ctx->base_count * 4;
> > > temp = malloc(size + 4096);
> > > memcpy(temp, ctx->base_data, size);
> > > memset((char *)temp + size, 0xd0, 4096);
> > > --
> > > 2.9.3
> > >
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-02-07 15:14 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-02 22:57 [PATCH libdrm] intel: avoid null pointer dereference Thomas Hindoe Paaboel Andersen
2017-02-03 10:57 ` Eric Engestrom
2017-02-07 14:59 ` Thomas H.P. Andersen
2017-02-07 15:14 ` Eric Engestrom
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).