Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 27d4a476 authored by Narender Ankam's avatar Narender Ankam
Browse files

msm: mdss: hdmi: correctly validate the cec msg frame size 



HDMI CEC message is being validated against the operand
size (MAX_OPERAND_SIZE). Instead validate against the
frame size (MAX_CEC_FRAME_SIZE).

Change-Id: I9fd66781feedbe9bc1090b0e28ef9d814edcca5a
Signed-off-by: default avatarNarender Ankam <nankam@codeaurora.org>
parent a5665f16

drivers/video/fbdev/msm/mdss_cec_core.c

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -681,7 +681,7 @@ static ssize_t cec_wta_msg(struct device *dev, 
	}

	spin_unlock_irqrestore(&ctl->lock, flags);



	if (msg->frame_size > MAX_OPERAND_SIZE) {

	if (msg->frame_size > MAX_CEC_FRAME_SIZE) {

		pr_err("msg frame too big!\n");

		ret = -EINVAL;

		goto end;