Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1dbf7874 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: mdss: Validate cursor image size"

parents df8ad3b0 718254e9

drivers/video/fbdev/msm/mdss_mdp_overlay.c

+11 −2
Original line number Diff line number Diff line
@@ -4367,12 +4367,21 @@ static int mdss_mdp_hw_cursor_pipe_update(struct msm_fb_data_type *mfd, 
		start_y = 0;

	}



	if ((img->width > mdata->max_cursor_size) ||

		(img->height > mdata->max_cursor_size) ||

		(img->depth != 32) || (start_x >= xres) ||

		(start_y >= yres)) {

		pr_err("Invalid cursor image coordinates\n");

		ret = -EINVAL;

		goto done;

	}



	roi.w = min(xres - start_x, img->width - roi.x);

	roi.h = min(yres - start_y, img->height - roi.y);



	if ((roi.w > mdata->max_cursor_size) ||

		(roi.h > mdata->max_cursor_size) ||

		(img->depth != 32) || (start_x >= xres) || (start_y >= yres)) {

		(roi.h > mdata->max_cursor_size)) {

		pr_err("Invalid cursor ROI size\n");

		ret = -EINVAL;

		goto done;

	}