Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3a181ce9 authored by Ping Li's avatar Ping Li
Browse files

msm: mdss: Add sanity check for Gamut LUT size 



The Gamut LUT size passed from user space needs to go through
a sanity check to avoid heap overflow. This patch adds the missing
sanity check in the Gamut LUT config write path.

Change-Id: I365938e06dbc6ca01961c9be01db10a5a9c863e4
Signed-off-by: default avatarPing Li <pingli@codeaurora.org>
parent 4b85ad60

drivers/video/msm/mdss/mdss_mdp_pp.c

+6 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -4671,6 +4671,11 @@ gamut_clk_off: 
				goto gamut_set_dirty;

			}

		}

		if (pp_gm_has_invalid_lut_size(config)) {

			pr_err("invalid lut size for gamut\n");

			ret = -EINVAL;

			goto gamut_config_exit;

		}

		local_cfg = *config;

		tbl_off = mdss_pp_res->gamut_tbl[disp_num];

		for (i = 0; i < MDP_GAMUT_TABLE_NUM; i++) {