Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a82f9c1 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: mdss: Add plane_count range check in mdss WFD"

parents af19d521 c649c9c1

drivers/video/fbdev/msm/mdss_mdp_layer.c

+6 −0
Original line number Diff line number Diff line
@@ -3035,6 +3035,12 @@ int mdss_mdp_layer_pre_commit_wfd(struct msm_fb_data_type *mfd, 
		wfd = mdp5_data->wfd;

		output_layer = commit->output_layer;



		if (output_layer->buffer.plane_count > MAX_PLANES) {

			pr_err("Output buffer plane_count exceeds MAX_PLANES limit:%d\n",

					output_layer->buffer.plane_count);

			return -EINVAL;

		}



		data = mdss_mdp_wfd_add_data(wfd, output_layer);

		if (IS_ERR_OR_NULL(data))

			return PTR_ERR(data);

drivers/video/fbdev/msm/mdss_mdp_wfd.c

+7 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -322,6 +322,12 @@ int mdss_mdp_wb_import_data(struct device *device, 
	if (wfd_data->layer.flags & MDP_LAYER_SECURE_SESSION)

		flags = MDP_SECURE_OVERLAY_SESSION;



	if (buffer->plane_count > MAX_PLANES) {

		pr_err("buffer plane_count exceeds MAX_PLANES limit:%d",

				buffer->plane_count);

		return -EINVAL;

	}



	memset(planes, 0, sizeof(planes));



	for (i = 0; i < buffer->plane_count; i++) {