Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f215d25 authored by Dan Carpenter's avatar Dan Carpenter Committed by Bartlomiej Zolnierkiewicz
Browse files

OMAPFB: prevent buffer underflow in omapfb_parse_vram_param() 



We cap the upper bound of "fbnum" but we also need to check for
negatives or make the type unsigned.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: default avatarBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
parent 5fa1f45d

drivers/video/fbdev/omap2/omapfb/omapfb-main.c

+1 −1
Original line number Diff line number Diff line
@@ -1477,7 +1477,7 @@ static int omapfb_alloc_fbmem_display(struct fb_info *fbi, unsigned long size, 
static int omapfb_parse_vram_param(const char *param, int max_entries,

		unsigned long *sizes, unsigned long *paddrs)

{

	int fbnum;

	unsigned int fbnum;

	unsigned long size;

	unsigned long paddr = 0;

	char *p, *start;