Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2025-08-03 20:04:21 -04:00
Code Issues Projects Releases Packages Wiki Activity

Switch to new CVE patchset

Browse source
This commit is contained in:
Tad 2017-11-07 17:32:46 -05:00
parent 57ce42402b
commit 11c7037780
1215 changed files with 60697 additions and 14533 deletions
Download patch file Download diff file Expand all files Collapse all files

35
Patches/Linux_CVEs/CVE-2017-9706/ANY/0001.patch Normal file
View file

@ -0,0 +1,35 @@
From 7489a0a8f68d0f018d0f9df5df157bb20f83b05e Mon Sep 17 00:00:00 2001
From: Bharath Gopal <gopalb@codeaurora.org>
Date: Fri, 4 Aug 2017 17:19:24 -0700
Subject: [PATCH] msm: mdss: Buffer overflow while processing gamut table data
Modified the size of the gamut table data-structure in order to
avoid a buffer overflow while copying data from user-space.
Bug: 34170483
Change-Id: I8c5fa1caff450a2d25d7859bd159ab4a60045e54
Signed-off-by: Bharath Gopal <gopalb@codeaurora.org>
---
drivers/video/msm/mdss/mdss_mdp_pp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/video/msm/mdss/mdss_mdp_pp.c b/drivers/video/msm/mdss/mdss_mdp_pp.c
index bd6d2fbd9c26e..a666f4c61d1ab 100644
--- a/drivers/video/msm/mdss/mdss_mdp_pp.c
+++ b/drivers/video/msm/mdss/mdss_mdp_pp.c
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -389,7 +389,7 @@ struct mdss_pp_res_type {
struct mdp_hist_lut_data enhist_disp_cfg[MDSS_BLOCK_DISP_NUM];
struct mdp_dither_cfg_data dither_disp_cfg[MDSS_BLOCK_DISP_NUM];
struct mdp_gamut_cfg_data gamut_disp_cfg[MDSS_BLOCK_DISP_NUM];
- uint16_t gamut_tbl[MDSS_BLOCK_DISP_NUM][GAMUT_TOTAL_TABLE_SIZE];
+ uint16_t gamut_tbl[MDSS_BLOCK_DISP_NUM][GAMUT_TOTAL_TABLE_SIZE * 3];
u32 hist_data[MDSS_BLOCK_DISP_NUM][HIST_V_SIZE];
struct pp_sts_type pp_disp_sts[MDSS_MAX_MIXER_DISP_NUM];
/* physical info */