The GUD protocol returns TV mode names as fixed-size
GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be
NUL-terminated.
gud_connector_add_tv_mode() currently passes each fixed-size entry
directly to drm_mode_create_tv_properties_legacy(), which eventually
reaches drm_property_add_enum() and strlen(). If a device returns an
entry without a terminating NUL byte, strlen() reads past the end of
the slot and can run beyond the allocated buffer, triggering an
out-of-bounds read.
Validate that each returned TV mode name contains a NUL terminator
within its fixed-size slot before passing it to the DRM property code.
If a malformed entry is found, reject the device response with -EIO.
This fixes the out-of-bounds read without changing the handling of
valid devices, and avoids silently truncating malformed protocol data.
Reported-by: [email protected]
Fixes: 40e1a70b4a ("drm: Add GUD USB Display driver")
Signed-off-by: Tao Yu <[email protected]>
Reviewed-by: Ruben Wauters <[email protected]>
Cc: <[email protected]>
Signed-off-by: Ruben Wauters <[email protected]>
Link: https://patch.msgid.link/[email protected]
Tao Yu
da1ea35fea