evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

drm/msm/sde: correct out of bound access in catalog

Browse source 
Correct validate function to use proper size clearing
property count array.
Correct copy format function to check bound before
accessing array element.

CRs-Fixed: 2037027
Change-Id: Ied3a8e91eb4e6c2c19632b8f83b35d94d1773bb1
Signed-off-by: Alan Kwong <akwong@codeaurora.org>
This commit is contained in:
Alan Kwong 2017-04-21 13:14:33 -07:00
parent 67bcb70ff7
commit 9d348d2480
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/gpu/drm/msm/sde/sde_hw_catalog.c
View file

@ -428,8 +428,8 @@ static uint32_t _sde_copy_formats(
return 0; return 0;
for (i = 0, cur_pos = dst_list_pos; for (i = 0, cur_pos = dst_list_pos;
(cur_pos < (dst_list_size - 1)) && src_list[i].fourcc_format (cur_pos < (dst_list_size - 1)) && (i < src_list_size)
&& (i < src_list_size); ++i, ++cur_pos) && src_list[i].fourcc_format; ++i, ++cur_pos)
dst_list[cur_pos] = src_list[i]; dst_list[cur_pos] = src_list[i];
dst_list[cur_pos].fourcc_format = 0; dst_list[cur_pos].fourcc_format = 0;
@ -503,6 +503,7 @@ static int _validate_dt_entry(struct device_node *np,
rc = -EINVAL; rc = -EINVAL;
} }
*off_count = 0; *off_count = 0;
memset(prop_count, 0, sizeof(int) * prop_size);
return rc; return rc;
} }
} }