From c6cfcd408df3e44d0094946c0a7d2fa944b4d2d1 Mon Sep 17 00:00:00 2001
From: Hong Liu <hong.liu@intel.com>
Date: Wed, 5 Dec 2007 17:48:28 +0100
Subject: [PATCH] Bug 13308: Verify and reject obviously broken modes.

---
 hw/xfree86/modes/xf86EdidModes.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c
index 777ef7e44..a125d8c82 100644
--- a/hw/xfree86/modes/xf86EdidModes.c
+++ b/hw/xfree86/modes/xf86EdidModes.c
@@ -328,6 +328,12 @@ DDCModeFromDetailedTiming(int scrnIndex, struct detailed_timings *timing,
     Mode->VSyncEnd = Mode->VSyncStart + timing->v_sync_width;
     Mode->VTotal = timing->v_active + timing->v_blanking;
 
+    /* perform basic check on the detail timing */
+    if (Mode->HSyncEnd > Mode->HTotal || Mode->VSyncEnd > Mode->VTotal) {
+	xfree(Mode);
+	return NULL;
+    }
+
     xf86SetModeDefaultName(Mode);
 
     /* We ignore h/v_size and h/v_border for now. */