Merge "msm: mdss: check the length of the external input buffer properly" (2b73a1ba) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/video/msm/mdss/mdss_dsi.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -953,7 +953,7 @@ static int mdss_dsi_cmd_flush(struct file *file, fl_owner_t id)
		while (len >= sizeof(*dchdr)) {
		dchdr = (struct dsi_ctrl_hdr *)bp;
		dchdr->dlen = ntohs(dchdr->dlen);
		if (dchdr->dlen > len) {
		if (dchdr->dlen > len \|\| dchdr->dlen < 0) {
		pr_err("%s: dtsi cmd=%x error, len=%d\n",
		__func__, dchdr->dtype, dchdr->dlen);
		kfree(buf);