From b5bb13e1f738f90df11e0c17f843c73999a84a54 Mon Sep 17 00:00:00 2001 From: Terence Hampson Date: Thu, 19 Sep 2013 10:53:18 -0400 Subject: mdss: mdp3: Validate input from userspace Fully verify that the values from client are safe to use. Change-Id: I73d6839f5bccd53b8bc2d812dc7673b13735299c Signed-off-by: Terence Hampson --- drivers/video/msm/mdss/mdp3_ctrl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/video/msm/mdss/mdp3_ctrl.c b/drivers/video/msm/mdss/mdp3_ctrl.c index ee51e92..1d6d437 100644 --- a/drivers/video/msm/mdss/mdp3_ctrl.c +++ b/drivers/video/msm/mdss/mdp3_ctrl.c @@ -1218,7 +1218,8 @@ static int mdp3_ctrl_lut_update(struct msm_fb_data_type *mfd, if (!mdp3_session->dma->config_lut) return -EINVAL; - if (cmap->start + cmap->len > MDP_LUT_SIZE) { + if (cmap->start > MDP_LUT_SIZE || cmap->len > MDP_LUT_SIZE || + (cmap->start + cmap->len > MDP_LUT_SIZE)) { pr_err("mdp3_ctrl_lut_update invalid arguments\n"); return -EINVAL; } -- cgit v1.1