evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

video: fbdev: Additional param checks on user space cmap

Browse source 
Additional bound checks for parameters that are used
to calculate target buffer address.

Change-Id: Ib4a00a51c761dc7751a19e6ee7f55cacac97860f
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
This commit is contained in:
Naseer Ahmed 2016-01-07 17:41:18 -05:00 • committed by David Keitel
parent df0d2be28a
commit 488f3d81d0
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/video/fbdev/core/fbcmap.c
View file

@ -194,11 +194,12 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
fromoff = to->start - from->start;
else
tooff = from->start - to->start;
if ((to->len <= tooff) || (from->len <= fromoff))
return -EINVAL;
size = to->len - tooff;
if (size > (int) (from->len - fromoff))
size = from->len - fromoff;
if (size <= 0)
return -EINVAL;
size *= sizeof(u16);
if (copy_to_user(to->red+tooff, from->red+fromoff, size))