From b119bd673b0512769820667d1812ed145d038845 Mon Sep 17 00:00:00 2001 From: Bharath Gopal Date: Mon, 15 May 2017 17:30:23 +0530 Subject: [PATCH] msm: mdss: Buffer overflow while processing gamut table data Modified the size of the gamut table data-structure in order to avoid a buffer overflow while copying data from user-space. Change-Id: I8c5fa1caff450a2d25d7859bd159ab4a60045e54 Signed-off-by: Bharath Gopal --- drivers/video/fbdev/msm/mdss_mdp_pp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/msm/mdss_mdp_pp.h b/drivers/video/fbdev/msm/mdss_mdp_pp.h index 809c389e99e8..136e2d79787c 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_pp.h +++ b/drivers/video/fbdev/msm/mdss_mdp_pp.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. + * Copyright (c) 2014-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -181,7 +181,7 @@ struct mdss_pp_res_type { struct mdp_hist_lut_data enhist_disp_cfg[MDSS_BLOCK_DISP_NUM]; struct mdp_dither_cfg_data dither_disp_cfg[MDSS_BLOCK_DISP_NUM]; struct mdp_gamut_cfg_data gamut_disp_cfg[MDSS_BLOCK_DISP_NUM]; - uint16_t gamut_tbl[MDSS_BLOCK_DISP_NUM][GAMUT_TOTAL_TABLE_SIZE]; + uint16_t gamut_tbl[MDSS_BLOCK_DISP_NUM][GAMUT_TOTAL_TABLE_SIZE * 3]; u32 hist_data[MDSS_BLOCK_DISP_NUM][HIST_V_SIZE]; struct pp_sts_type pp_disp_sts[MDSS_BLOCK_DISP_NUM]; struct mdp_dither_cfg_data pa_dither_cfg[MDSS_BLOCK_DISP_NUM];