Commit 64c94695 authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Dave Airlie

decode: check streamout-targets num_handles

Prevent out-of-bound array access.

Found thanks to AddressSanitizer & american fuzzy lop.
Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
parent b93e67de
......@@ -1025,6 +1025,9 @@ static int vrend_decode_set_streamout_targets(struct vrend_decode_ctx *ctx,
if (length < 1)
return EINVAL;
if (num_handles > ARRAY_SIZE(handles))
return EINVAL;
append_bitmask = get_buf_entry(ctx, VIRGL_SET_STREAMOUT_TARGETS_APPEND_BITMASK);
for (i = 0; i < num_handles; i++)
handles[i] = get_buf_entry(ctx, VIRGL_SET_STREAMOUT_TARGETS_H0 + i);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment