From 0b3abacb6430e6593c4358420ba457d8149bd32b Mon Sep 17 00:00:00 2001 From: Torsten Kaiser Date: Fri, 6 Jul 2012 12:06:13 -0700 Subject: [PATCH] xfree86: EDID Est III parsing can walk off end of array Using -O3 gcc notes that m could reach beyound the end of the EstIIIModes array, if the last bits of the 11s byte where set. Fix this, by extending the array to cover all possible bits from est. https://bugs.freedesktop.org/show_bug.cgi?id=45623 Signed-off-by: Torsten Kaiser Reviewed-by: Adam Jackson Signed-off-by: Keith Packard --- hw/xfree86/modes/xf86EdidModes.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c index 8aa82d114..47c169c5b 100644 --- a/hw/xfree86/modes/xf86EdidModes.c +++ b/hw/xfree86/modes/xf86EdidModes.c @@ -723,7 +723,13 @@ static const struct { 1920, 1200, 75, 0}, { 1920, 1200, 85, 0}, { 1920, 1440, 60, 0}, { -1920, 1440, 75, 0},}; + 1920, 1440, 75, 0}, + /* fill up last byte */ + { + 0,0,0,0}, { + 0,0,0,0}, { + 0,0,0,0}, { + 0,0,0,0}, }; static DisplayModePtr DDCModesFromEstIII(unsigned char *est) @@ -735,7 +741,8 @@ DDCModesFromEstIII(unsigned char *est) for (j = 7; j > 0; j--) { if (est[i] & (1 << j)) { m = (i * 8) + (7 - j); - modes = xf86ModesAdd(modes, + if (EstIIIModes[m].w) + modes = xf86ModesAdd(modes, FindDMTMode(EstIIIModes[m].w, EstIIIModes[m].h, EstIIIModes[m].r,