linux-kernel - Re: [2.6.37-rc7] drivers/gpu/drm/drm_edid.c:1303: warning: array subscript is above array bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20101225192008.GA2325@del.dom.local>
Date:	Sat, 25 Dec 2010 20:20:08 +0100
From:	Jarek Poplawski <jarkao2@...il.com>
To:	Chris Wilson <chris@...is-wilson.co.uk>
Cc:	Linux Kernel <linux-kernel@...r.kernel.org>,
	David Airlie <airlied@...ux.ie>,
	dri-devel@...ts.freedesktop.org
Subject: Re: [2.6.37-rc7] drivers/gpu/drm/drm_edid.c:1303: warning: array
 subscript is above array bounds

On Sat, Dec 25, 2010 at 01:38:56PM +0000, Chris Wilson wrote:
> On Sat, 25 Dec 2010 14:13:43 +0100, Jarek Poplawski <jarkao2@...il.com> wrote:
> > Hi,
> > There is this compile warning in Linus' tree (gcc version 4.3.3):
> > 
> > drivers/gpu/drm/drm_edid.c: In function 'drm_detect_hdmi_monitor':
> > drivers/gpu/drm/drm_edid.c:1303: warning: array subscript is above array bounds
> > drivers/gpu/drm/drm_edid.c: In function 'drm_detect_monitor_audio':
> > drivers/gpu/drm/drm_edid.c:1303: warning: array subscript is above array bounds
> 
> What array? It's declared as "u8 *edid_ext;". At first glance looks like a
> compiler bug, applying subscript testing to an object with unknown bounds.

Maybe a bug but then also something very unique in this place wrt the
rest of the kernel (at least in my config). Btw, a patch below removes
this warning.

Jarek P.

--- drm_edid.c-	2010-12-25 19:24:55.000000000 +0100
+++ drm_edid.c	2010-12-25 19:51:45.000000000 +0100
@@ -1290,7 +1290,7 @@ add_detailed_modes(struct drm_connector 
  */
 static u8 *drm_find_cea_extension(struct edid *edid)
 {
-	u8 *edid_ext = NULL;
+	char *edid_ext = NULL;
 	int i;
 
 	/* No EDID or EDID extensions */
@@ -1299,7 +1299,7 @@ static u8 *drm_find_cea_extension(struct
 
 	/* Find CEA extension */
 	for (i = 0; i < edid->extensions; i++) {
-		edid_ext = (u8 *)edid + EDID_LENGTH * (i + 1);
+		edid_ext = (char *)edid + EDID_LENGTH * (i + 1);
 		if (edid_ext[0] == CEA_EXT)
 			break;
 	}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/