From: Harry Wentland <[email protected]>
[Why]
mod_hdcp_dump_binary_message() computed target_size (a uint32_t) as roughly
byte_size * msg_size and gated the whole write on buf_size >= target_size. A
large msg_size can overflow target_size, wrapping it to a small value that
passes the check while the loop still writes byte_size * msg_size bytes
into buf. All current callers pass small constants so this is not reachable
today, but the unchecked arithmetic should be hardened.
[How]
Drop the overflow-prone target_size precomputation and instead bounds-check the
output position on every iteration, stopping once the next entry would not leave
room for the trailing terminator. This cannot overflow and, for oversized
messages, dumps as much as fits rather than printing nothing.
Fixes: 4c283fdac08a ("drm/amd/display: Add HDCP module")
Cc: [email protected]
Assisted-by: Copilot:claude-opus-4.8
Reviewed-by: Alex Hung <[email protected]>
Signed-off-by: Harry Wentland <[email protected]>
Signed-off-by: George Zhang <[email protected]>
---
.../drm/amd/display/modules/hdcp/hdcp_log.c | 30 +++++++++++--------
1 file changed, 18 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c
b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c
index 1164fd96b714..f0f8e280ed30 100644
--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c
+++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c
@@ -33,22 +33,28 @@ void mod_hdcp_dump_binary_message(uint8_t *msg, uint32_t
msg_size,
byte_size = 3,
newline_size = 1,
terminator_size = 1;
- uint32_t line_count = msg_size / bytes_per_line,
- trailing_bytes = msg_size % bytes_per_line;
- uint32_t target_size = (byte_size * bytes_per_line + newline_size) *
line_count +
- byte_size * trailing_bytes + newline_size +
terminator_size;
uint32_t buf_pos = 0;
uint32_t i = 0;
- if (buf_size >= target_size) {
- for (i = 0; i < msg_size; i++) {
- if (i % bytes_per_line == 0)
- buf[buf_pos++] = '\n';
- sprintf((char *)&buf[buf_pos], "%02X ", msg[i]);
- buf_pos += byte_size;
- }
- buf[buf_pos++] = '\0';
+ /* Need room for at least the terminator. */
+ if (buf_size < terminator_size)
+ return;
+
+ for (i = 0; i < msg_size; i++) {
+ uint32_t needed = byte_size + terminator_size;
+
+ if (i % bytes_per_line == 0)
+ needed += newline_size;
+
+ if (buf_pos + needed > buf_size)
+ break;
+
+ if (i % bytes_per_line == 0)
+ buf[buf_pos++] = '\n';
+ sprintf((char *)&buf[buf_pos], "%02X ", msg[i]);
+ buf_pos += byte_size;
}
+ buf[buf_pos++] = '\0';
}
void mod_hdcp_log_ddc_trace(struct mod_hdcp *hdcp)
--
2.53.0
