From dba97196b935f08f6b03c241927fea2ebb685720 Mon Sep 17 00:00:00 2001 From: Ingrid Gallardo Date: Fri, 11 Nov 2016 14:13:57 -0800 Subject: [PATCH] msm: mdss: Avoid accessing pipe out of the boundaries When display driver looks for a pipe, it checks for the number of rectangles that the pipe allows. This number only needs to be obtained from the base pipe and there is no need to check for this number on each of the rectangles of the base pipe. Current code, gets this number for the base pipe and for each of its rectangles while iterating the list of pointers; main problem is that in the loop through the rectangles, the pointer to the 'pipe' has been already increased at the end of the 'for' loop; which causes that the check to see if the iterations need to continue is done against the next element of the list; this is mainly a problem for the last element of the list, since the pointer would be something beyond the boundaries of the list. Change-Id: Ie4ac72e460643606f718d5809e65cda70932fb84 Signed-off-by: Ingrid Gallardo --- drivers/video/fbdev/msm/mdss_mdp_pipe.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/msm/mdss_mdp_pipe.c b/drivers/video/fbdev/msm/mdss_mdp_pipe.c index e370a80ad998..bcf5309993b9 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_pipe.c +++ b/drivers/video/fbdev/msm/mdss_mdp_pipe.c @@ -1340,10 +1340,11 @@ static struct mdss_mdp_pipe *__pipe_lookup(struct mdss_mdp_pipe *pipe_list, bool (*cmp)(struct mdss_mdp_pipe *, void *), void *data) { struct mdss_mdp_pipe *pipe; - int i, j; + int i, j, max_rects; for (i = 0, pipe = pipe_list; i < count; i++) { - for (j = 0; j < pipe->multirect.max_rects; j++, pipe++) + max_rects = pipe->multirect.max_rects; + for (j = 0; j < max_rects; j++, pipe++) if ((rect_num == pipe->multirect.num) && cmp(pipe, data)) return pipe;