From 17b37501db36fb1723e31ea17961b66df7432fc7 Mon Sep 17 00:00:00 2001 From: Ping Li Date: Tue, 3 Jan 2017 13:19:32 -0800 Subject: msm: mdss: Add sanity check for Gamut LUT size The Gamut LUT size passed from user space needs to go through a sanity check to avoid heap overflow. This patch adds the missing sanity check in the Gamut LUT config write path. Change-Id: I365938e06dbc6ca01961c9be01db10a5a9c863e4 Signed-off-by: Ping Li --- drivers/video/msm/mdss/mdss_mdp_pp.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/video/msm/mdss/mdss_mdp_pp.c b/drivers/video/msm/mdss/mdss_mdp_pp.c index 3960595..029fad1 100644 --- a/drivers/video/msm/mdss/mdss_mdp_pp.c +++ b/drivers/video/msm/mdss/mdss_mdp_pp.c @@ -4671,6 +4671,11 @@ gamut_clk_off: goto gamut_set_dirty; } } + if (pp_gm_has_invalid_lut_size(config)) { + pr_err("invalid lut size for gamut\n"); + ret = -EINVAL; + goto gamut_config_exit; + } local_cfg = *config; tbl_off = mdss_pp_res->gamut_tbl[disp_num]; for (i = 0; i < MDP_GAMUT_TABLE_NUM; i++) { -- cgit v1.1