Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cbac0b3a authored by Alan Kwong's avatar Alan Kwong
Browse files

drm/msm/sde: correct out of bound access in catalog 



Correct validate function to use proper size clearing
property count array.
Correct copy format function to check bound before
accessing array element.

CRs-Fixed: 2037027
Change-Id: Ied3a8e91eb4e6c2c19632b8f83b35d94d1773bb1
Signed-off-by: default avatarAlan Kwong <akwong@codeaurora.org>
parent 979ef22a

drivers/gpu/drm/msm/sde/sde_hw_catalog.c

+3 −3
Original line number Diff line number Diff line
@@ -490,8 +490,8 @@ static uint32_t _sde_copy_formats( 
		return 0;



	for (i = 0, cur_pos = dst_list_pos;

		(cur_pos < (dst_list_size - 1)) && src_list[i].fourcc_format

		&& (i < src_list_size); ++i, ++cur_pos)

		(cur_pos < (dst_list_size - 1)) && (i < src_list_size)

		&& src_list[i].fourcc_format; ++i, ++cur_pos)

		dst_list[cur_pos] = src_list[i];



	dst_list[cur_pos].fourcc_format = 0;
@@ -565,7 +565,7 @@ static int _validate_dt_entry(struct device_node *np, 
				rc = -EINVAL;

			}

			*off_count = 0;

			memset(prop_count, 0, sizeof(int *) * prop_size);

			memset(prop_count, 0, sizeof(int) * prop_size);

			return rc;

		}

	}