drivers/video/fbdev/core/fbmon.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c index 3558a70a6664..2ab1fd6e33b7 100644 --- a/drivers/video/fbdev/core/fbmon.c +++ b/drivers/video/fbdev/core/fbmon.c @@ -1030,7 +1030,9 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs) if (type == 2) { for (i = pos; i < pos + len; i++) { u8 idx = edid[pos + i] & 0x7f; - svd[svd_n++] = idx; + if (svd_n < sizeof(svd)) + svd[svd_n] = idx; + svd_n++; pr_debug("N%sative mode #%d\n", edid[pos + i] & 0x80 ? "" : "on-n", idx); } @@ -1044,6 +1046,10 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs) pos += len + 1; } + /* Evil monitor? */ + if (WARN_ON_ONCE(svd_n > sizeof(svd))) + return; + block = edid + edid[2]; DPRINTK(" Extended Detailed Timings\n");