Merge "msm: mdss: hdmi: check up-bound of CEC frame size" (bba3dcc4) · Commits · e / devices / android_kernel_sony_msm8998

drivers/video/fbdev/msm/mdss_hdmi_cec.c

+3 −3

Original line number	Diff line number	Diff line
		/* Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -196,7 +196,7 @@ static void hdmi_cec_msg_recv(struct work_struct *work)
		msg.sender_id, msg.recvr_id,
		msg.frame_size);

		if (msg.frame_size < 1) {
		if (msg.frame_size < 1 \|\| msg.frame_size > MAX_CEC_FRAME_SIZE) {
		DEV_ERR("%s: invalid message (frame length = %d)\n",
		__func__, msg.frame_size);
		return;
		@@ -216,7 +216,7 @@ static void hdmi_cec_msg_recv(struct work_struct *work)
		msg.operand[i] = data & 0xFF;
		}

		for (; i < 14; i++)
		for (; i < MAX_OPERAND_SIZE; i++)
		msg.operand[i] = 0;

		DEV_DBG("%s: opcode 0x%x, wakup_en %d, device_suspend %d\n", __func__,