diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2010-08-04 09:46:01 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2010-08-04 09:46:01 +0100 |
| commit | 2b7263b771d94401cb4ea6cbf4dc7a295eeda7c0 (patch) | |
| tree | 4cb81a7270eafd9a19098b9972bf1ae59dfb34ab | |
| parent | 56629166915155628e70e6ec8052c0d220a8bb68 (diff) | |
display: Check for buffer overrun in output name lookup.
The kernel may know about more types than we do, so protect ourselves
from reading from beyond the end of the string array.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
| -rw-r--r-- | src/intel_display.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/intel_display.c b/src/intel_display.c index 276cd460..e4961eae 100644 --- a/src/intel_display.c +++ b/src/intel_display.c @@ -1250,6 +1250,7 @@ intel_output_init(ScrnInfoPtr scrn, struct intel_mode *mode, int num) drmModeConnectorPtr koutput; drmModeEncoderPtr kencoder; struct intel_output *intel_output; + const char *output_name; char name[32]; koutput = drmModeGetConnector(mode->fd, @@ -1263,8 +1264,11 @@ intel_output_init(ScrnInfoPtr scrn, struct intel_mode *mode, int num) return; } - snprintf(name, 32, "%s%d", output_names[koutput->connector_type], - koutput->connector_type_id); + if (koutput->connector_type < ARRAY_SIZE(output_names)) + output_name = output_names[koutput->connector_type]; + else + output_name = "UNKNOWN"; + snprintf(name, 32, "%s%d", output_name, koutput->connector_type_id); output = xf86OutputCreate (scrn, &intel_output_funcs, name); if (!output) { |