fbdev: tgafb: Fix potential divide by zero
fb_set_var would by called when user invokes ioctl with cmd FBIOPUT_VSCREENINFO. User-provided data would finally reach tgafb_check_var. In case var->pixclock is assigned to zero, divide by zero would occur when checking whether reciprocal of var->pixclock is too high. Similar crashes have happened in other fbdev drivers. There is no check and modification on var->pixclock along the call chain to tgafb_check_var. We believe it could also be triggered in driver tgafb from user site. Signed-off-by: Wei Chen <harperchen1110@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
This commit is contained in:
Родитель
33bf61c0a1
Коммит
f90bd245de
|
@ -173,6 +173,9 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
|
|||
{
|
||||
struct tga_par *par = (struct tga_par *)info->par;
|
||||
|
||||
if (!var->pixclock)
|
||||
return -EINVAL;
|
||||
|
||||
if (par->tga_type == TGA_TYPE_8PLANE) {
|
||||
if (var->bits_per_pixel != 8)
|
||||
return -EINVAL;
|
||||
|
|
Загрузка…
Ссылка в новой задаче