Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 718254e9 authored by Naseer Ahmed's avatar Naseer Ahmed Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: Validate cursor image size 



Check size of cursor image provided by userspace and return error
appropriately.

Bug: 34125463
CRs-Fixed: 1115406
Change-Id: I31aee3c9219921cf5c4306b36f8708582b838c38
Signed-off-by: default avatarNaseer Ahmed <naseer@codeaurora.org>
Signed-off-by: default avatarRajkumar Subbiah <rsubbia@codeaurora.org>
parent 9bf70038

drivers/video/fbdev/msm/mdss_mdp_overlay.c

+11 −2
Original line number Diff line number Diff line
@@ -4367,12 +4367,21 @@ static int mdss_mdp_hw_cursor_pipe_update(struct msm_fb_data_type *mfd, 
		start_y = 0;

	}



	if ((img->width > mdata->max_cursor_size) ||

		(img->height > mdata->max_cursor_size) ||

		(img->depth != 32) || (start_x >= xres) ||

		(start_y >= yres)) {

		pr_err("Invalid cursor image coordinates\n");

		ret = -EINVAL;

		goto done;

	}



	roi.w = min(xres - start_x, img->width - roi.x);

	roi.h = min(yres - start_y, img->height - roi.y);



	if ((roi.w > mdata->max_cursor_size) ||

		(roi.h > mdata->max_cursor_size) ||

		(img->depth != 32) || (start_x >= xres) || (start_y >= yres)) {

		(roi.h > mdata->max_cursor_size)) {

		pr_err("Invalid cursor ROI size\n");

		ret = -EINVAL;

		goto done;

	}