Re: [PATCH] fbdev: udlfb: validate vendor descriptor items

[Helge Deller]

On 7/18/26 20:26, Helge Deller wrote:
> On 7/6/26 11:30, Pengpeng Hou wrote:
> > dlfb_parse_vendor_descriptor() walks key-length-value items inside the
> > DisplayLink vendor descriptor.
> >
> > Require each item to contain its key, length and declared value bytes
> > before reading item-specific fields such as max_area.
> >
> > Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> > ---
> >   drivers/video/fbdev/udlfb.c | 22 ++++++++++++++++------
> >   1 file changed, 16 insertions(+), 6 deletions(-)
> >
> > diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
> > index fdbb8671a810..e78d6f95c9c5 100644
> > --- a/drivers/video/fbdev/udlfb.c
> > +++ b/drivers/video/fbdev/udlfb.c
> > @@ -1586,19 +1586,29 @@ static int dlfb_parse_vendor_descriptor(struct dlfb_data *dlfb,
> >           desc += 5; /* the fixed header we've already parsed */
> >           while (desc < desc_end) {
> > +            char *value;
> >               u8 length;
> >               u16 key;
> > -            key = *desc++;
> > -            key |= (u16)*desc++ << 8;
> > +            if (desc_end - desc < sizeof(key) + sizeof(length))
> > +                goto unrecognized;
> > +
> > +            key = get_unaligned_le16(desc);
>
> Is there a reason why you switch to unconditional little-endian reads?
> Is this "vendor descriptor" always little-endian?
> If yes, then your patch is probably correct.
> If not, I think your patch will most likely break big-endian machines.
Please ignore my comments above.
I should have looked more closely.
Your patch is of course correct!

The patch is now added to fbdev git tree.

Thanks!
Helge