From c675380c56437a522c54e179131d42cb96f6e6cf Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Tue, 13 Dec 2022 18:27:58 +0100 Subject: [PATCH] backend/drm: prevent out-of-bounds array access on unknown subpixel If the kernel adds new enum entries for subpixel, don't read past the end of the subpixel_map array. --- backend/drm/drm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/drm/drm.c b/backend/drm/drm.c index 380e5629..94bf2059 100644 --- a/backend/drm/drm.c +++ b/backend/drm/drm.c @@ -1245,7 +1245,11 @@ static void connect_drm_connector(struct wlr_drm_connector *wlr_conn, wlr_conn->output.phys_height = drm_conn->mmHeight; wlr_log(WLR_INFO, "Physical size: %"PRId32"x%"PRId32, wlr_conn->output.phys_width, wlr_conn->output.phys_height); - wlr_conn->output.subpixel = subpixel_map[drm_conn->subpixel]; + if (drm_conn->subpixel < sizeof(subpixel_map) / sizeof(subpixel_map[0])) { + wlr_conn->output.subpixel = subpixel_map[drm_conn->subpixel]; + } else { + wlr_log(WLR_ERROR, "Unknown subpixel value: %d", (int)drm_conn->subpixel); + } get_drm_connector_props(drm->fd, wlr_conn->id, &wlr_conn->props);