diff options
| author | Ping Li <pingli@codeaurora.org> | 2017-01-03 11:48:06 -0800 |
|---|---|---|
| committer | Ping Li <pingli@codeaurora.org> | 2017-01-12 13:41:35 -0800 |
| commit | cf3c97b8b6165f13810e530068fbf94b07f1f77d (patch) | |
| tree | 5588782fcc05ac02bcf6dbc9202ef898e956978f | |
| parent | 2dc96b1cbbdcf5aef3780696708012d55fec57f2 (diff) | |
msm: mdss: Add sanity check for Gamut LUT size
The Gamut LUT size passed from user space needs to go through
a sanity check to avoid heap overflow. This patch adds the missing
sanity check in the Gamut LUT config write path.
Change-Id: I365938e06dbc6ca01961c9be01db10a5a9c863e4
Signed-off-by: Ping Li <pingli@codeaurora.org>
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_mdp_pp.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/video/fbdev/msm/mdss_mdp_pp.c b/drivers/video/fbdev/msm/mdss_mdp_pp.c index 30dd3c856c7f..951beae8a154 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_pp.c +++ b/drivers/video/fbdev/msm/mdss_mdp_pp.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -4827,6 +4827,11 @@ gamut_clk_off: goto gamut_set_dirty; } } + if (pp_gm_has_invalid_lut_size(config)) { + pr_debug("invalid lut size for gamut\n"); + ret = -EINVAL; + goto gamut_config_exit; + } local_cfg = *config; tbl_off = mdss_pp_res->gamut_tbl[disp_num]; for (i = 0; i < MDP_GAMUT_TABLE_NUM; i++) { |