evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: mdss: Validate cursor image size"

Browse source
This commit is contained in:
Linux Build Service Account 2017-03-13 11:50:01 -07:00 • committed by Gerrit - the friendly Code Review server
commit 1dbf7874c4
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/video/fbdev/msm/mdss_mdp_overlay.c
View file

@ -4367,12 +4367,21 @@ static int mdss_mdp_hw_cursor_pipe_update(struct msm_fb_data_type *mfd,
start_y = 0;
}
if ((img->width > mdata->max_cursor_size) ||
(img->height > mdata->max_cursor_size) ||
(img->depth != 32) || (start_x >= xres) ||
(start_y >= yres)) {
pr_err("Invalid cursor image coordinates\n");
ret = -EINVAL;
goto done;
}
roi.w = min(xres - start_x, img->width - roi.x);
roi.h = min(yres - start_y, img->height - roi.y);
if ((roi.w > mdata->max_cursor_size) ||
(roi.h > mdata->max_cursor_size) ||
(img->depth != 32) || (start_x >= xres) || (start_y >= yres)) {
(roi.h > mdata->max_cursor_size)) {
pr_err("Invalid cursor ROI size\n");
ret = -EINVAL;
goto done;
}