Skip to content

Commit e421946

Browse files
Fullway Wanghdeller
authored andcommitted
fbdev: sis: Error out if pixclock equals zero
The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. In sisfb_check_var(), var->pixclock is used as a divisor to caculate drate before it is checked against zero. Fix this by checking it at the beginning. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Signed-off-by: Fullway Wang <fullwaywang@outlook.com> Signed-off-by: Helge Deller <deller@gmx.de>
1 parent 04e5eac commit e421946

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

drivers/video/fbdev/sis/sis_main.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1444,6 +1444,8 @@ sisfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
14441444

14451445
vtotal = var->upper_margin + var->lower_margin + var->vsync_len;
14461446

1447+
if (!var->pixclock)
1448+
return -EINVAL;
14471449
pixclock = var->pixclock;
14481450

14491451
if((var->vmode & FB_VMODE_MASK) == FB_VMODE_NONINTERLACED) {

0 commit comments

Comments
 (0)