Re: [PATCH] drm/vmwgfx: Potential off by one in vmw_view_add()

Hi! On 01/10/2018 10:40 AM, Dan Carpenter wrote: The vmw_view_cmd_to_type() function returns vmw_view_max (3) on error. It's one element beyond the end of the vmw_view_cotables[] table. My read on this is that it's possible to hit this failure. header->id comes from vmw_cmd_check() and it's a

[PATCH] drm/vmwgfx: Potential off by one in vmw_view_add()

The vmw_view_cmd_to_type() function returns vmw_view_max (3) on error. It's one element beyond the end of the vmw_view_cotables[] table. My read on this is that it's possible to hit this failure. header->id comes from vmw_cmd_check() and it's a user controlled number between 1040 and 1225 so we c