Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5ae43c4 authored by Pawan Kumar's avatar Pawan Kumar
Browse files

fbmem: Check failure of FBIOPUTCMAP ioctl



On FBIOPUTCMAP ioctl failure deallocate
fb cmap. Put null check for cmap red, green,
blue component.

Change-Id: I10468ee30d0e76c256cf3d7a6ffe14db7fd4511b
Signed-off-by: default avatarPawan Kumar <pavaku@codeaurora.org>
parent e11a9da9
Loading
Loading
Loading
Loading
+21 −9
Original line number Diff line number Diff line
@@ -166,6 +166,9 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
	int tooff = 0, fromoff = 0;
	int size;

	if (!to || !from)
		return -EINVAL;

	if (to->start > from->start)
		fromoff = to->start - from->start;
	else
@@ -177,8 +180,11 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
		return -EINVAL;
	size *= sizeof(u16);

	if (from->red && to->red)
		memcpy(to->red+tooff, from->red+fromoff, size);
	if (from->green && to->green)
		memcpy(to->green+tooff, from->green+fromoff, size);
	if (from->blue && to->blue)
		memcpy(to->blue+tooff, from->blue+fromoff, size);
	if (from->transp && to->transp)
		memcpy(to->transp+tooff, from->transp+fromoff, size);
@@ -190,6 +196,9 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
	int tooff = 0, fromoff = 0;
	int size;

	if (!to || !from)
		return -EINVAL;

	if (to->start > from->start)
		fromoff = to->start - from->start;
	else
@@ -201,10 +210,13 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
		return -EINVAL;
	size *= sizeof(u16);

	if (from->red && to->red)
		if (copy_to_user(to->red+tooff, from->red+fromoff, size))
			return -EFAULT;
	if (from->green && to->green)
		if (copy_to_user(to->green+tooff, from->green+fromoff, size))
			return -EFAULT;
	if (from->blue && to->blue)
		if (copy_to_user(to->blue+tooff, from->blue+fromoff, size))
			return -EFAULT;
	if (from->transp && to->transp)
+4 −0
Original line number Diff line number Diff line
@@ -1122,6 +1122,10 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
		if (copy_from_user(&cmap, argp, sizeof(cmap)))
			return -EFAULT;
		ret = fb_set_user_cmap(&cmap, info);
		if (ret) {
			if (info)
				fb_dealloc_cmap(&info->cmap);
		}
		break;
	case FBIOGETCMAP:
		if (copy_from_user(&cmap, argp, sizeof(cmap)))