diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-05 20:53:33 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-05 20:53:32 -0800 |
| commit | 3e6913ada917cbe58cf76dc2ec0a062d220c0a30 (patch) | |
| tree | 0ae95375ad9e485b736827d056bdcf4c9aaff3e8 | |
| parent | cae1e1f5d16e7797b9faec4df29d00c285a7e95a (diff) | |
| parent | f46f39735feb6d659ff019282726380448871ddf (diff) | |
Merge "msm: mdss: Fix possible integer overflow"
| -rw-r--r-- | drivers/video/fbdev/msm/mdp3_ctrl.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/video/fbdev/msm/mdp3_ctrl.c b/drivers/video/fbdev/msm/mdp3_ctrl.c index da6c68d43b53..fc89a2ea772e 100644 --- a/drivers/video/fbdev/msm/mdp3_ctrl.c +++ b/drivers/video/fbdev/msm/mdp3_ctrl.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -2147,8 +2147,10 @@ static int mdp3_ctrl_lut_config(struct msm_fb_data_type *mfd, dma = mdp3_session->dma; - if (cfg->cmap.start + cfg->cmap.len > MDP_LUT_SIZE) { - pr_err("Invalid arguments\n"); + if ((cfg->cmap.start > MDP_LUT_SIZE) || + (cfg->cmap.len > MDP_LUT_SIZE) || + (cfg->cmap.start + cfg->cmap.len > MDP_LUT_SIZE)) { + pr_err("Invalid arguments.\n"); return -EINVAL; } |