Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5ae43c4 authored by Pawan Kumar's avatar Pawan Kumar
Browse files

fbmem: Check failure of FBIOPUTCMAP ioctl 



On FBIOPUTCMAP ioctl failure deallocate
fb cmap. Put null check for cmap red, green,
blue component.

Change-Id: I10468ee30d0e76c256cf3d7a6ffe14db7fd4511b
Signed-off-by: default avatarPawan Kumar <pavaku@codeaurora.org>
parent e11a9da9

drivers/video/fbcmap.c

+21 −9
Original line number Diff line number Diff line
@@ -166,6 +166,9 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) 
	int tooff = 0, fromoff = 0;

	int size;



	if (!to || !from)

		return -EINVAL;



	if (to->start > from->start)

		fromoff = to->start - from->start;

	else
@@ -177,8 +180,11 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) 
		return -EINVAL;

	size *= sizeof(u16);



	if (from->red && to->red)

		memcpy(to->red+tooff, from->red+fromoff, size);

	if (from->green && to->green)

		memcpy(to->green+tooff, from->green+fromoff, size);

	if (from->blue && to->blue)

		memcpy(to->blue+tooff, from->blue+fromoff, size);

	if (from->transp && to->transp)

		memcpy(to->transp+tooff, from->transp+fromoff, size);
@@ -190,6 +196,9 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) 
	int tooff = 0, fromoff = 0;

	int size;



	if (!to || !from)

		return -EINVAL;



	if (to->start > from->start)

		fromoff = to->start - from->start;

	else
@@ -201,10 +210,13 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) 
		return -EINVAL;

	size *= sizeof(u16);



	if (from->red && to->red)

		if (copy_to_user(to->red+tooff, from->red+fromoff, size))

			return -EFAULT;

	if (from->green && to->green)

		if (copy_to_user(to->green+tooff, from->green+fromoff, size))

			return -EFAULT;

	if (from->blue && to->blue)

		if (copy_to_user(to->blue+tooff, from->blue+fromoff, size))

			return -EFAULT;

	if (from->transp && to->transp)

drivers/video/fbmem.c

+4 −0
Original line number Diff line number Diff line
@@ -1122,6 +1122,10 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, 
		if (copy_from_user(&cmap, argp, sizeof(cmap)))

			return -EFAULT;

		ret = fb_set_user_cmap(&cmap, info);

		if (ret) {

			if (info)

				fb_dealloc_cmap(&info->cmap);

		}

		break;

	case FBIOGETCMAP:

		if (copy_from_user(&cmap, argp, sizeof(cmap)))