evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: kgsl: Fix integer overflow in _load_gpmu_firmware

Browse source 
There is a possibility of integer overflow in the arithmetic
calculation for cmd_size. Fix this by adding checks for such
arithmetic.

Change-Id: I2298a32f8ba3411decb29f55bb7b55e2214de35a
Signed-off-by: Abhilash Kumar <krabhi@codeaurora.org>
This commit is contained in:
Abhilash Kumar 2017-07-28 16:29:53 +05:30 • committed by Gerrit - the friendly Code Review server
parent d4a6462641
commit fde778c14a
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/gpu/msm/adreno_a5xx.c
View file

@ -715,6 +715,10 @@ static int _load_gpmu_firmware(struct adreno_device *adreno_dev)
if (ret)
goto err;
/* Integer overflow check for cmd_size */
if (data[2] > (data[0] - 2))
goto err;
cmds = data + data[2] + 3;
cmd_size = data[0] - data[2] - 2;