Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Out of bounds access when edid parsing fails #860

Closed
oliverchang opened this issue Apr 27, 2023 · 0 comments · Fixed by #859
Closed

Out of bounds access when edid parsing fails #860

oliverchang opened this issue Apr 27, 2023 · 0 comments · Fixed by #859

Comments

@oliverchang
Copy link

oliverchang commented Apr 27, 2023

On certain configurations the EDID retrieval and parsing seems to fail, leading to create_patched_edid accessing out of bounds indexes on a zero length vector. This causes gamescope to crash on launch.

In my gamescope output I see:

...
drm: Failed to parse edid
...
/usr/include/c++/12.2.1/bits/stl_vector.h:1123: constexpr std::vector<_Tp, _Alloc>::reference std::vector<_Tp, _Alloc>::operator[](size_type) [with _Tp = unsigned char; _Alloc = std::allocator<unsigned char>; reference = unsigned char&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.
(EE) failed to read Wayland events: Connection reset by peer
(EE) failed to read Wayland events: Broken pipe

While an error is logged in the case where parsing fails, this was not handled as edid_data is assumed to contain valid and non-empty data
as it's passed to create_patched_edid.

This points to a potential underlying bug in di_info_parse_edid in libdisplay-info, but it still seems reasonable to guard against parsing errors in general?

The offending input to di_info_parse_edid in libdisplay-info is (base64 encoded):

AP///////wAHIQEBBwYhIDEgAQSlCQ94qrBlplZTnSgMUFQAAAABAQEBAQEBAQEBAQEBAQEBSxog
NjAAIlASEkQEXpcAAAAeKhrQjCAAKFBACKABXpcAAAAeUxFYpCDAGDBECMQAXpcAAAAeAAAA/ABB
WUFORU9XWEdBCiAgAXoCAxAw0FAgAC5QIAqgAXG1LRjQoCCAKEBACIQBXpcAAAAenhYAjDAAOEAw
CqgBXpcAAAAeiw9YoCAgWDA4EIQCXpcAAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVg==
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant