diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-06-18 16:31:07 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-06-18 16:31:07 -0700 |
| commit | f8d804ef051ca3e556089776f08a538616ea2e64 (patch) | |
| tree | f0e31ee8e1ba4c5ddbaf9e36bba11b5fa4fd56ea | |
| parent | 59c83129d1f5434f364200ff4e2d3930fe015f04 (diff) | |
| parent | 2be7caec635de9fcf0d2145f858635e9366f0f4f (diff) | |
Merge "msm: mdss: validate page id before reading from edid buffer"
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_hdmi_edid.c | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/drivers/video/fbdev/msm/mdss_hdmi_edid.c b/drivers/video/fbdev/msm/mdss_hdmi_edid.c index ddc5edbe010d..a953dd1a2ac2 100644 --- a/drivers/video/fbdev/msm/mdss_hdmi_edid.c +++ b/drivers/video/fbdev/msm/mdss_hdmi_edid.c @@ -469,8 +469,10 @@ static ssize_t hdmi_edid_sysfs_wta_res_info(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { int rc, page_id; + u32 i = 0, j, page; ssize_t ret = strnlen(buf, PAGE_SIZE); struct hdmi_edid_ctrl *edid_ctrl = hdmi_edid_get_ctrl(dev); + struct msm_hdmi_mode_timing_info info = {0}; if (!edid_ctrl) { DEV_ERR("%s: invalid input\n", __func__); @@ -483,7 +485,22 @@ static ssize_t hdmi_edid_sysfs_wta_res_info(struct device *dev, return rc; } - edid_ctrl->page_id = page_id; + if (page_id > MSM_HDMI_INIT_RES_PAGE) { + page = MSM_HDMI_INIT_RES_PAGE; + while (page < page_id) { + j = 1; + while (sizeof(info) * j < PAGE_SIZE) { + i++; + j++; + } + page++; + } + } + + if (i < HDMI_VFRMT_MAX) + edid_ctrl->page_id = page_id; + else + DEV_ERR("%s: invalid page id\n", __func__); DEV_DBG("%s: %d\n", __func__, edid_ctrl->page_id); return ret; |