evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: Avoid accessing pipe out of the boundaries

Browse source 
When display driver looks for a pipe, it checks for
the number of rectangles that the pipe allows.
This number only needs to be obtained from the base
pipe and there is no need to check for this number
on each of the rectangles of the base pipe.
Current code, gets this number for the base pipe
and for each of its rectangles while iterating the
list of pointers; main problem is that in the
loop through the rectangles, the pointer to the
'pipe' has been already increased at the end of the
'for' loop; which causes that the check to see if
the iterations need to continue is done against the
next element of the list; this is mainly a problem
for the last element of the list, since the pointer
would be something beyond the boundaries of the list.

Change-Id: Ie4ac72e460643606f718d5809e65cda70932fb84
Signed-off-by: Ingrid Gallardo <ingridg@codeaurora.org>
This commit is contained in:
Ingrid Gallardo 2016-11-11 14:13:57 -08:00 • committed by Gerrit - the friendly Code Review server
parent 8e69887600
commit dba97196b9
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/video/fbdev/msm/mdss_mdp_pipe.c
View file

@ -1340,10 +1340,11 @@ static struct mdss_mdp_pipe *__pipe_lookup(struct mdss_mdp_pipe *pipe_list,
bool (*cmp)(struct mdss_mdp_pipe *, void *), void *data)
{
struct mdss_mdp_pipe *pipe;
int i, j;
int i, j, max_rects;
for (i = 0, pipe = pipe_list; i < count; i++) {
for (j = 0; j < pipe->multirect.max_rects; j++, pipe++)
max_rects = pipe->multirect.max_rects;
for (j = 0; j < max_rects; j++, pipe++)
if ((rect_num == pipe->multirect.num) &&
cmp(pipe, data))
return pipe;