msm: sde: Add check for plane_count range in SDE rotator



Buffer plane_count is provided from user, and it is necessary to check
the range of the given value is within MAX_PLANES definition. Without
the check can cause possible buffer overrun access.

Change-Id: I96d914d63dd504cc2b0c50424986f4d7333e5d8d
Signed-off-by: Benjamin Chan <bkchan@codeaurora.org>

parent 7684fb14

drivers/media/platform/msm/sde/rotator/sde_rotator_core.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -515,6 +515,12 @@ static int sde_rotator_import_buffer(struct sde_layer_buffer *buffer,
		if (!input)
		dir = DMA_FROM_DEVICE;

		if (buffer->plane_count > SDE_ROT_MAX_PLANES) {
		SDEROT_ERR("buffer plane_count exceeds MAX_PLANE limit:%d\n",
		buffer->plane_count);
		return -EINVAL;
		}

		memset(planes, 0, sizeof(planes));

		for (i = 0; i < buffer->plane_count; i++) {