Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f9b6f51 authored by Harsh Sahu's avatar Harsh Sahu
Browse files

msm: mdss: fix memcpy source and dest memory buffer size mismatch 



Currently memcpy is copying from a bigger memory size to a smaller
memory size. This change corrects this issue by performing the
memcopy restricted to the smaller of the src or dest memory buffer.

Change-Id: Ibbe5665083799a4262d3cfbb06f94f3e35e03748
Signed-off-by: default avatarHarsh Sahu <hsahu@codeaurora.org>
parent 68b6c46c

drivers/video/msm/mdss/mdss_compat_utils.c

+4 −1
Original line number Diff line number Diff line
@@ -119,6 +119,9 @@ static unsigned int __do_compat_ioctl_nr(unsigned int cmd32) 
static void  __copy_atomic_commit_struct(struct mdp_layer_commit  *commit,

	struct mdp_layer_commit32 *commit32)

{

	unsigned int destsize = sizeof(commit->commit_v1.reserved);

	unsigned int srcsize = sizeof(commit32->commit_v1.reserved);

	unsigned int count = (destsize <= srcsize ? destsize : srcsize);

	commit->version = commit32->version;

	commit->commit_v1.flags = commit32->commit_v1.flags;

	commit->commit_v1.input_layer_cnt =
@@ -126,7 +129,7 @@ static void __copy_atomic_commit_struct(struct mdp_layer_commit *commit, 
	commit->commit_v1.left_roi = commit32->commit_v1.left_roi;

	commit->commit_v1.right_roi = commit32->commit_v1.right_roi;

	memcpy(&commit->commit_v1.reserved, &commit32->commit_v1.reserved,

		sizeof(commit32->commit_v1.reserved));

		count);

}



static struct mdp_input_layer32 *__create_layer_list32(