evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "fbdev: use unsigned integers to prevent overflow"

Browse source
This commit is contained in:
Linux Build Service Account 2016-10-14 03:40:30 -07:00 • committed by Gerrit - the friendly Code Review server
commit 65767b7f53
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/video/fbdev/core/fbcmap.c
View file

@ -187,8 +187,8 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
{ {
int tooff = 0, fromoff = 0; u32 tooff = 0, fromoff = 0;
int size; u32 size;
if (to->start > from->start) if (to->start > from->start)
fromoff = to->start - from->start; fromoff = to->start - from->start;
@ -198,10 +198,10 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
return -EINVAL; return -EINVAL;
size = to->len - tooff; size = to->len - tooff;
if (size > (int) (from->len - fromoff)) if (size > (from->len - fromoff))
size = from->len - fromoff; size = from->len - fromoff;
size *= sizeof(u16); size *= sizeof(u16);
if (!size) if (size == 0)
return -EINVAL; return -EINVAL;
if (copy_to_user(to->red+tooff, from->red+fromoff, size)) if (copy_to_user(to->red+tooff, from->red+fromoff, size))