projects
/
linux.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
2b6f588
)
gma/gma500: fix a memory disclosure bug due to uninitialized bytes
author
Kangjie Lu
<kjlu@umn.edu>
Fri, 18 Oct 2019 04:29:53 +0000
(23:29 -0500)
committer
Daniel Vetter
<daniel.vetter@ffwll.ch>
Tue, 22 Oct 2019 08:59:36 +0000
(10:59 +0200)
`best_clock` is an object that may be sent out. Object `clock`
contains uninitialized bytes that are copied to `best_clock`,
which leads to memory disclosure and information leak.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link:
https://patchwork.freedesktop.org/patch/msgid/20191018042953.31099-1-kjlu@umn.edu
drivers/gpu/drm/gma500/cdv_intel_display.c
patch
|
blob
|
history
diff --git
a/drivers/gpu/drm/gma500/cdv_intel_display.c
b/drivers/gpu/drm/gma500/cdv_intel_display.c
index f56852a503e8d8d98bebe77889488b47e24ea72b..8b784947ed3b91940af86f96f8f342cfce46b7bc 100644
(file)
--- a/
drivers/gpu/drm/gma500/cdv_intel_display.c
+++ b/
drivers/gpu/drm/gma500/cdv_intel_display.c
@@
-405,6
+405,8
@@
static bool cdv_intel_find_dp_pll(const struct gma_limit_t *limit,
struct gma_crtc *gma_crtc = to_gma_crtc(crtc);
struct gma_clock_t clock;
+ memset(&clock, 0, sizeof(clock));
+
switch (refclk) {
case 27000:
if (target < 200000) {