diff options
| author | Ashish Garg <ashigarg@codeaurora.org> | 2017-06-09 15:52:13 +0530 |
|---|---|---|
| committer | Ashish Garg <ashigarg@codeaurora.org> | 2017-06-09 15:52:44 +0530 |
| commit | 7f24865a8a82d6af4d5ab74309a9e20fed795fa7 (patch) | |
| tree | 53c9f551b1f74a0824738d86f4aaa9ffdbbf51e1 /drivers/video/fbdev/msm | |
| parent | 55a25be010f62b574938ef3da38c50738db78cff (diff) | |
msm: mdss: size check before writing to edid buffer
To update custom edid through sysfs node, there was no check
on the edid size passed. The user can overwrite the edid buffer.
To prevent buffer overflow, ensure that edid size is validated
with the edid buffer size before writing to the buffer.
Change-Id: I8604ea2d25f3a4985749bd037497d242b0621519
Signed-off-by: Ashish Garg <ashigarg@codeaurora.org>
Diffstat (limited to 'drivers/video/fbdev/msm')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_hdmi_tx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/video/fbdev/msm/mdss_hdmi_tx.c b/drivers/video/fbdev/msm/mdss_hdmi_tx.c index a9ab970fb4bc..1062216eb5bc 100644 --- a/drivers/video/fbdev/msm/mdss_hdmi_tx.c +++ b/drivers/video/fbdev/msm/mdss_hdmi_tx.c @@ -581,7 +581,8 @@ static ssize_t hdmi_tx_sysfs_wta_edid(struct device *dev, } mutex_lock(&hdmi_ctrl->tx_lock); - if (edid_size < EDID_BLOCK_SIZE) { + if ((edid_size < EDID_BLOCK_SIZE) || + (edid_size > hdmi_ctrl->edid_buf_size)) { DEV_DBG("%s: disabling custom edid\n", __func__); ret = -EINVAL; |