diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2016-08-30 05:43:46 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-08-30 05:43:46 -0700 |
| commit | ab26d098793adbf90b77d414663e34ac0c7315f6 (patch) | |
| tree | ea1d337eb39cc953b0c30fe47cb16f37696a9bf1 /drivers | |
| parent | 019b7d0c64e51994db7fb7122516400805abb2d4 (diff) | |
| parent | 62e764006d48225ba2a0a8015ba7085c0e8dab12 (diff) | |
Merge "msm: mdss: Fix to validate data copied from user space"
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_mdp_overlay.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/video/fbdev/msm/mdss_mdp_overlay.c b/drivers/video/fbdev/msm/mdss_mdp_overlay.c index 04e3c09e36d7..9dda467e53cc 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_overlay.c +++ b/drivers/video/fbdev/msm/mdss_mdp_overlay.c @@ -4429,16 +4429,20 @@ static int __mdss_overlay_src_split_sort(struct msm_fb_data_type *mfd, __overlay_swap_func); for (i = 0; i < num_ovs; i++) { + if (ovs[i].z_order >= MDSS_MDP_MAX_STAGE) { + pr_err("invalid stage:%u\n", ovs[i].z_order); + return -EINVAL; + } if (ovs[i].dst_rect.x < left_lm_w) { if (left_lm_zo_cnt[ovs[i].z_order] == 2) { - pr_err("more than 2 ov @ stage%d on left lm\n", + pr_err("more than 2 ov @ stage%u on left lm\n", ovs[i].z_order); return -EINVAL; } left_lm_zo_cnt[ovs[i].z_order]++; } else { if (right_lm_zo_cnt[ovs[i].z_order] == 2) { - pr_err("more than 2 ov @ stage%d on right lm\n", + pr_err("more than 2 ov @ stage%u on right lm\n", ovs[i].z_order); return -EINVAL; } |