mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
36 lines
1.6 KiB
Diff
36 lines
1.6 KiB
Diff
|
From 7489a0a8f68d0f018d0f9df5df157bb20f83b05e Mon Sep 17 00:00:00 2001
|
||
|
|
From: Bharath Gopal <gopalb@codeaurora.org>
|
||
|
|
Date: Fri, 4 Aug 2017 17:19:24 -0700
|
||
|
|
Subject: [PATCH] msm: mdss: Buffer overflow while processing gamut table data
|
||
|
|
|
||
|
|
Modified the size of the gamut table data-structure in order to
|
||
|
|
avoid a buffer overflow while copying data from user-space.
|
||
|
|
|
||
|
|
Bug: 34170483
|
||
|
|
Change-Id: I8c5fa1caff450a2d25d7859bd159ab4a60045e54
|
||
|
|
Signed-off-by: Bharath Gopal <gopalb@codeaurora.org>
|
||
|
|
---
|
||
|
|
drivers/video/msm/mdss/mdss_mdp_pp.c | 4 ++--
|
||
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/drivers/video/msm/mdss/mdss_mdp_pp.c b/drivers/video/msm/mdss/mdss_mdp_pp.c
|
||
|
|
index bd6d2fbd9c26e..a666f4c61d1ab 100644
|
||
|
|
--- a/drivers/video/msm/mdss/mdss_mdp_pp.c
|
||
|
|
+++ b/drivers/video/msm/mdss/mdss_mdp_pp.c
|
||
|
|
@@ -1,5 +1,5 @@
|
||
|
|
/*
|
||
|
|
- * Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
|
||
|
|
+ * Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
|
||
|
|
*
|
||
|
|
* This program is free software; you can redistribute it and/or modify
|
||
|
|
* it under the terms of the GNU General Public License version 2 and
|
||
|
|
@@ -389,7 +389,7 @@ struct mdss_pp_res_type {
|
||
|
|
struct mdp_hist_lut_data enhist_disp_cfg[MDSS_BLOCK_DISP_NUM];
|
||
|
|
struct mdp_dither_cfg_data dither_disp_cfg[MDSS_BLOCK_DISP_NUM];
|
||
|
|
struct mdp_gamut_cfg_data gamut_disp_cfg[MDSS_BLOCK_DISP_NUM];
|
||
|
|
- uint16_t gamut_tbl[MDSS_BLOCK_DISP_NUM][GAMUT_TOTAL_TABLE_SIZE];
|
||
|
|
+ uint16_t gamut_tbl[MDSS_BLOCK_DISP_NUM][GAMUT_TOTAL_TABLE_SIZE * 3];
|
||
|
|
u32 hist_data[MDSS_BLOCK_DISP_NUM][HIST_V_SIZE];
|
||
|
|
struct pp_sts_type pp_disp_sts[MDSS_MAX_MIXER_DISP_NUM];
|
||
|
|
/* physical info */
|