diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-03-13 11:50:01 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-03-13 11:50:01 -0700 |
| commit | 1dbf7874c40d2f4a1c5defccdfcc87be47613fac (patch) | |
| tree | 3713318fd3c1f7f6a8c211b8531c5d0debd61cd0 | |
| parent | df8ad3b00f915bab056a86e62d19c0ecebfb6ece (diff) | |
| parent | 718254e9fd705087be92603deb531f66d9a97c35 (diff) | |
Merge "msm: mdss: Validate cursor image size"
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_mdp_overlay.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/drivers/video/fbdev/msm/mdss_mdp_overlay.c b/drivers/video/fbdev/msm/mdss_mdp_overlay.c index 9e295815da77..f81f815fafea 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_overlay.c +++ b/drivers/video/fbdev/msm/mdss_mdp_overlay.c @@ -4367,12 +4367,21 @@ static int mdss_mdp_hw_cursor_pipe_update(struct msm_fb_data_type *mfd, start_y = 0; } + if ((img->width > mdata->max_cursor_size) || + (img->height > mdata->max_cursor_size) || + (img->depth != 32) || (start_x >= xres) || + (start_y >= yres)) { + pr_err("Invalid cursor image coordinates\n"); + ret = -EINVAL; + goto done; + } + roi.w = min(xres - start_x, img->width - roi.x); roi.h = min(yres - start_y, img->height - roi.y); if ((roi.w > mdata->max_cursor_size) || - (roi.h > mdata->max_cursor_size) || - (img->depth != 32) || (start_x >= xres) || (start_y >= yres)) { + (roi.h > mdata->max_cursor_size)) { + pr_err("Invalid cursor ROI size\n"); ret = -EINVAL; goto done; } |