fbdev: bitblit: bound-check glyph index in bit_putcs*

bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.

This fixes a global out-of-bounds read reported by syzbot.

Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org

diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index a9ec7f488522c6a6ba2ff63df1c3c85fe4ba80ea..dc5ad3fcc7be4b62486a0ddcfa2bec8ee79fe96e 100644 (file)
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(struct vc_data *vc, struct fb_info *info,
                                     struct fb_image *image, u8 *buf, u8 *dst)
 {
        u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+       unsigned int charcnt = vc->vc_font.charcount;
        u32 idx = vc->vc_font.width >> 3;
        u8 *src;
 
        while (cnt--) {
-               src = vc->vc_font.data + (scr_readw(s++)&
-                                         charmask)*cellsize;
+               u16 ch = scr_readw(s++) & charmask;
+
+               if (ch >= charcnt)
+                       ch = 0;
+               src = vc->vc_font.data + (unsigned int)ch * cellsize;
 
                if (attr) {
                        update_attr(buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(struct vc_data *vc,
                                       u8 *dst)
 {
        u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+       unsigned int charcnt = vc->vc_font.charcount;
        u32 shift_low = 0, mod = vc->vc_font.width % 8;
        u32 shift_high = 8;
        u32 idx = vc->vc_font.width >> 3;
        u8 *src;
 
        while (cnt--) {
-               src = vc->vc_font.data + (scr_readw(s++)&
-                                         charmask)*cellsize;
+               u16 ch = scr_readw(s++) & charmask;
+
+               if (ch >= charcnt)
+                       ch = 0;
+               src = vc->vc_font.data + (unsigned int)ch * cellsize;
 
                if (attr) {
                        update_attr(buf, src, attr, vc);