evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: fix memcpy source and dest memory buffer size mismatch

Browse source 
Currently memcpy is copying from a bigger memory size to a smaller
memory size. This change corrects this issue by performing the
memcopy restricted to the smaller of the src or dest memory buffer.

CRs-fixed: 2028228
Change-Id: Ibbe5665083799a4262d3cfbb06f94f3e35e03748
Signed-off-by: Harsh Sahu <hsahu@codeaurora.org>
This commit is contained in:
Harsh Sahu 2017-04-21 16:12:22 -07:00 • committed by Gerrit - the friendly Code Review server
parent 5d78c03af8
commit ad8e758d30
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/video/fbdev/msm/mdss_compat_utils.c
View file

@ -119,6 +119,9 @@ static unsigned int __do_compat_ioctl_nr(unsigned int cmd32)
static void __copy_atomic_commit_struct(struct mdp_layer_commit *commit,
struct mdp_layer_commit32 *commit32)
{
unsigned int destSize = sizeof(commit->commit_v1.reserved);
unsigned int srcSize = sizeof(commit32->commit_v1.reserved);
unsigned int count = (destSize <= srcSize ? destSize : srcSize);
commit->version = commit32->version;
commit->commit_v1.flags = commit32->commit_v1.flags;
commit->commit_v1.input_layer_cnt =
@ -127,7 +130,7 @@ static void __copy_atomic_commit_struct(struct mdp_layer_commit *commit,
commit->commit_v1.right_roi = commit32->commit_v1.right_roi;
commit->commit_v1.bl_level = commit32->commit_v1.bl_level;
memcpy(&commit->commit_v1.reserved, &commit32->commit_v1.reserved,
sizeof(commit32->commit_v1.reserved));
count);
}
static struct mdp_input_layer32 *__create_layer_list32(