diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-10-05 03:06:35 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-10-05 03:06:35 -0700 |
| commit | 56fee295de70121673c750f81f36f9bf92094a66 (patch) | |
| tree | e814da2e03cad27d0cf3e710fb6d3925556f38de /drivers/video/fbdev | |
| parent | db14d9203141acfcc5b54697a891633cf45baade (diff) | |
| parent | 93e91f73b211165a24708da0367429cbdffc33a1 (diff) | |
Merge "msm: mdss: check the length of the external input buffer properly"
Diffstat (limited to 'drivers/video/fbdev')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_dsi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/video/fbdev/msm/mdss_dsi.c b/drivers/video/fbdev/msm/mdss_dsi.c index 5f7e7c6bcde0..7b6153503af5 100644 --- a/drivers/video/fbdev/msm/mdss_dsi.c +++ b/drivers/video/fbdev/msm/mdss_dsi.c @@ -968,7 +968,7 @@ static int mdss_dsi_cmd_flush(struct file *file, fl_owner_t id) while (len >= sizeof(*dchdr)) { dchdr = (struct dsi_ctrl_hdr *)bp; dchdr->dlen = ntohs(dchdr->dlen); - if (dchdr->dlen > len) { + if (dchdr->dlen > len || dchdr->dlen < 0) { pr_err("%s: dtsi cmd=%x error, len=%d\n", __func__, dchdr->dtype, dchdr->dlen); kfree(buf); |