Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 718254e9 authored by Naseer Ahmed's avatar Naseer Ahmed Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: Validate cursor image size



Check size of cursor image provided by userspace and return error
appropriately.

Bug: 34125463
CRs-Fixed: 1115406
Change-Id: I31aee3c9219921cf5c4306b36f8708582b838c38
Signed-off-by: default avatarNaseer Ahmed <naseer@codeaurora.org>
Signed-off-by: default avatarRajkumar Subbiah <rsubbia@codeaurora.org>
parent 9bf70038
Loading
Loading
Loading
Loading
+11 −2
Original line number Diff line number Diff line
@@ -4367,12 +4367,21 @@ static int mdss_mdp_hw_cursor_pipe_update(struct msm_fb_data_type *mfd,
		start_y = 0;
	}

	if ((img->width > mdata->max_cursor_size) ||
		(img->height > mdata->max_cursor_size) ||
		(img->depth != 32) || (start_x >= xres) ||
		(start_y >= yres)) {
		pr_err("Invalid cursor image coordinates\n");
		ret = -EINVAL;
		goto done;
	}

	roi.w = min(xres - start_x, img->width - roi.x);
	roi.h = min(yres - start_y, img->height - roi.y);

	if ((roi.w > mdata->max_cursor_size) ||
		(roi.h > mdata->max_cursor_size) ||
		(img->depth != 32) || (start_x >= xres) || (start_y >= yres)) {
		(roi.h > mdata->max_cursor_size)) {
		pr_err("Invalid cursor ROI size\n");
		ret = -EINVAL;
		goto done;
	}