evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: Validate cursor image size

Browse source 
Check size of cursor image provided by userspace and return error
appropriately.

Bug: 34125463
CRs-Fixed: 1115406
Change-Id: I31aee3c9219921cf5c4306b36f8708582b838c38
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Signed-off-by: Rajkumar Subbiah <rsubbia@codeaurora.org>
This commit is contained in:
Naseer Ahmed 2017-01-11 12:57:48 -05:00 • committed by Gerrit - the friendly Code Review server
parent 9bf700385d
commit 718254e9fd
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/video/fbdev/msm/mdss_mdp_overlay.c
View file

@ -4367,12 +4367,21 @@ static int mdss_mdp_hw_cursor_pipe_update(struct msm_fb_data_type *mfd,
start_y = 0;
}
if ((img->width > mdata->max_cursor_size) ||
(img->height > mdata->max_cursor_size) ||
(img->depth != 32) || (start_x >= xres) ||
(start_y >= yres)) {
pr_err("Invalid cursor image coordinates\n");
ret = -EINVAL;
goto done;
}
roi.w = min(xres - start_x, img->width - roi.x);
roi.h = min(yres - start_y, img->height - roi.y);
if ((roi.w > mdata->max_cursor_size) ||
(roi.h > mdata->max_cursor_size) ||
(img->depth != 32) || (start_x >= xres) || (start_y >= yres)) {
(roi.h > mdata->max_cursor_size)) {
pr_err("Invalid cursor ROI size\n");
ret = -EINVAL;
goto done;
}