Merge "msm: mdss: validate number of cea blocks before reading from edid_buf" (7d1911a6) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/video/msm/mdss/mdss_hdmi_tx.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -595,6 +595,11 @@ static ssize_t hdmi_tx_sysfs_rda_edid(struct device *dev,

		mutex_lock(&hdmi_ctrl->tx_lock);
		cea_blks = hdmi_ctrl->edid_buf[EDID_BLOCK_SIZE - 2];
		if (cea_blks >= MAX_EDID_BLOCKS) {
		DEV_ERR("%s: invalid cea blocks\n", __func__);
		mutex_unlock(&hdmi_ctrl->tx_lock);
		return -EINVAL;
		}
		size = (cea_blks + 1) * EDID_BLOCK_SIZE;
		size = min_t(u32, size, PAGE_SIZE);