diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-06-18 16:31:09 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-06-18 16:31:08 -0700 |
| commit | 7527441950e7fe5e4915c8fae058a7afe68cb271 (patch) | |
| tree | 7091e22ec369901064b6233e937cc30028567d0a /drivers/video/fbdev/msm | |
| parent | cfdc77c29d93be15eacf9636cdf6ba233d4aed86 (diff) | |
| parent | c01e9da28071d7691b34fc6a3f122338187287cc (diff) | |
Merge "msm: mdss: validate number of cea blocks before reading from edid_buf"
Diffstat (limited to 'drivers/video/fbdev/msm')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_hdmi_tx.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/video/fbdev/msm/mdss_hdmi_tx.c b/drivers/video/fbdev/msm/mdss_hdmi_tx.c index 1062216eb5bc..2e267f2695d7 100644 --- a/drivers/video/fbdev/msm/mdss_hdmi_tx.c +++ b/drivers/video/fbdev/msm/mdss_hdmi_tx.c @@ -634,6 +634,11 @@ static ssize_t hdmi_tx_sysfs_rda_edid(struct device *dev, mutex_lock(&hdmi_ctrl->tx_lock); cea_blks = hdmi_ctrl->edid_buf[EDID_BLOCK_SIZE - 2]; + if (cea_blks >= MAX_EDID_BLOCKS) { + DEV_ERR("%s: invalid cea blocks\n", __func__); + mutex_unlock(&hdmi_ctrl->tx_lock); + return -EINVAL; + } size = (cea_blks + 1) * EDID_BLOCK_SIZE; size = min_t(u32, size, PAGE_SIZE); |