linux/drivers/video/fbdev
Andrey Shumilin 9cf14f5a27 fbdev: sisfb: Fix strbuf array overflow
The values of the variables xres and yres are placed in strbuf.
These variables are obtained from strbuf1.
The strbuf1 array contains digit characters
and a space if the array contains non-digit characters.
Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres);
more than 16 bytes will be written to strbuf.
It is suggested to increase the size of the strbuf array to 24.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Andrey Shumilin <shum.sdl@nppct.ru>
Signed-off-by: Helge Deller <deller@gmx.de>
2024-09-28 00:42:11 +02:00
..
aty
core fbcon: break earlier in search_fb_in_map and search_for_mapped_con 2024-09-26 18:25:12 +02:00
geode
i810
kyro
matrox
mb862xx
mmp fbdev: mmp: Use devm_clk_get_enabled() helpers 2024-08-30 18:42:38 +02:00
nvidia
omap fbdev: omapfb: Use sysfs_emit_at() to simplify code 2024-08-30 18:42:38 +02:00
omap2 fbdev: omapfb: Call of_node_put(ep) only once in omapdss_of_find_source_for_first_ep() 2024-09-26 18:20:27 +02:00
riva
savage
sis fbdev: sisfb: Fix strbuf array overflow 2024-09-28 00:42:11 +02:00
via
68328fb.c
Kconfig
Makefile
acornfb.c
acornfb.h
amifb.c
arcfb.c
arkfb.c
asiliantfb.c
atafb.c
atafb.h
atafb_iplan2p2.c
atafb_iplan2p4.c
atafb_iplan2p8.c
atafb_mfb.c
atafb_utils.h
atmel_lcdfb.c
au1100fb.c
au1100fb.h
au1200fb.c
au1200fb.h
broadsheetfb.c
bt431.h
bt455.h
bw2.c
c2p.h
c2p_core.h
c2p_iplan2.c
c2p_planar.c
carminefb.c
carminefb.h
carminefb_regs.h
cg3.c
cg6.c
cg14.c
chipsfb.c
cirrusfb.c
clps711x-fb.c
cobalt_lcdfb.c
controlfb.c
controlfb.h
cyber2000fb.c
cyber2000fb.h
da8xx-fb.c
dnfb.c
edid.h
efifb.c fbdev: efifb: Use driver-private screen_info for sysfs 2024-08-30 18:42:38 +02:00
ep93xx-fb.c
ffb.c
fm2fb.c
fsl-diu-fb.c
g364fb.c
gbefb.c
goldfishfb.c
grvga.c
gxt4500.c
hecubafb.c
hgafb.c
hitfb.c
hpfb.c fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() 2024-08-30 18:42:38 +02:00
hyperv_fb.c fbdev: hyperv_fb: Convert comma to semicolon 2024-09-02 13:54:57 +02:00
i740_reg.h
i740fb.c
imsttfb.c fbdev: imsttfb: convert comma to semicolon 2024-09-02 13:54:26 +02:00
imxfb.c
leo.c
macfb.c
macmodes.c
macmodes.h
maxinefb.c
metronomefb.c
n411.c
neofb.c
ocfb.c
offb.c
p9100.c
platinumfb.c
platinumfb.h
pm2fb.c
pm3fb.c
pmag-aa-fb.c
pmag-ba-fb.c
pmagb-b-fb.c
ps3fb.c
pvr2fb.c
pxa3xx-gcu.c fbdev: pxa3xx-gcu: Convert comma to semicolon 2024-09-02 13:54:25 +02:00
pxa3xx-gcu.h
pxa3xx-regs.h
pxa168fb.c
pxa168fb.h
pxafb.c fbdev: pxafb: Fix possible use after free in pxafb_task() 2024-09-11 19:36:29 +02:00
pxafb.h
q40fb.c
s1d13xxxfb.c
s3c-fb.c
s3fb.c
sa1100fb.c
sa1100fb.h
sbuslib.c
sbuslib.h
sh7760fb.c
sh_mobile_lcdcfb.c
sh_mobile_lcdcfb.h
simplefb.c
skeletonfb.c
sm501fb.c
sm712.h
sm712fb.c
smscufx.c
ssd1307fb.c
sstfb.c
stifb.c
sunxvr500.c
sunxvr1000.c
sunxvr2500.c
tcx.c
tdfxfb.c
tgafb.c
tridentfb.c
udlfb.c
uvesafb.c
valkyriefb.c
valkyriefb.h
vesafb.c
vfb.c
vga16fb.c
vt8500lcdfb.c
vt8500lcdfb.h
vt8623fb.c
wm8505fb.c
wm8505fb_regs.h
wmt_ge_rops.c
wmt_ge_rops.h
xen-fbfront.c fbdev: xen-fbfront: Assign fb_info->device 2024-09-11 07:58:18 +02:00
xilinxfb.c