Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07324253 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "DRM: SDE: Fix potential buffer overflow in SDE encoder"

parents b02928f9 6252123a
Loading
Loading
Loading
Loading
+8 −4
Original line number Diff line number Diff line
@@ -43,6 +43,8 @@
/* timeout in frames waiting for frame done */
#define SDE_ENCODER_FRAME_DONE_TIMEOUT	60

#define MISR_BUFF_SIZE	256

/*
 * Two to anticipate panels that can do cmd/vid dynamic switching
 * plan is to create all possible physical encoder types, and switch between
@@ -1046,16 +1048,18 @@ static ssize_t _sde_encoder_misr_set(struct file *file,
	struct sde_encoder_virt *sde_enc;
	struct drm_encoder *drm_enc;
	int i = 0;
	char buf[10];
	char buf[MISR_BUFF_SIZE + 1];
	size_t buff_copy;
	u32 enable, frame_count;

	drm_enc = file->private_data;
	sde_enc = to_sde_encoder_virt(drm_enc);

	if (copy_from_user(buf, user_buf, count))
		return -EFAULT;
	buff_copy = min_t(size_t, MISR_BUFF_SIZE, count);
	if (copy_from_user(buf, user_buf, buff_copy))
		return -EINVAL;

	buf[count] = 0; /* end of string */
	buf[buff_copy] = 0; /* end of string */

	if (sscanf(buf, "%u %u", &enable, &frame_count) != 2)
		return -EFAULT;