On 10/20/25 16:29, Thomas Zimmermann wrote:
Hi
Am 20.10.25 um 15:47 schrieb Junjie Cao:
bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
Tested-by: [email protected]
Signed-off-by: Junjie Cao <[email protected]>
Reviewed-by: Thomas Zimmermann <[email protected]>
...
v1:
https://lore.kernel.org/linux-fbdev/[email protected]/
v1 -> v2:
- Fix indentation and add blank line after declarations with the .pl helper
- No functional changes
drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
applied.
Thanks!
Helge
