ui/display/util/edid_parser.cc - Issue 2249973006: ui: Fix potential out-of-bounds array access in EDID parser

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: ui/display/util/edid_parser.cc

Issue 2249973006: ui: Fix potential out-of-bounds array access in EDID parser (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Add header byte to size check Created 4 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

Index: ui/display/util/edid_parser.cc

diff --git a/ui/display/util/edid_parser.cc b/ui/display/util/edid_parser.cc

index 5bc2e62a00e051a02fc2ec202ddd5b074c1a0f5e..f72dbca4dce0c9eca925debfeeb2253c91461dd8 100644

--- a/ui/display/util/edid_parser.cc

+++ b/ui/display/util/edid_parser.cc

@@ -235,7 +235,7 @@ bool ParseOutputOverscanFlag(const std::vector<uint8_t>& edid,

// - byte 3: the capability.

unsigned char tag = edid[data_offset] >> 5;

unsigned char payload_length = edid[data_offset] & 0x1f;

- if (data_offset + payload_length > edid.size())

+ if (data_offset + payload_length + 1 > edid.size())

break;

if (tag != kExtendedTag || payload_length < 2 ||

« no previous file with comments | « no previous file | no next file » | no next file with comments »