sysfb FbSize Overflow

Vulnerability analysis

The Open Firmware framebuffer driver reads display dimensions (line width and height) from the device tree during boot and multiplies them to compute the total framebuffer size. Because both values are stored as signed integers, their multiplication can silently overflow when the dimensions are large, producing an incorrect size that the driver then uses to set up the framebuffer — potentially causing out-of-bounds memory access or a kernel crash. The fix replaces the unchecked multiplication with a helper that detects overflow and aborts initialization with an error if it occurs. This vulnerability is only reachable through the device tree, which is supplied by firmware at boot time; an attacker would need either root-level access to modify the boot configuration or device tree overlays, or physical access to alter the firmware directly.