Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be23453d authored by Kalyan Thota's avatar Kalyan Thota Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: Fix out of bound read access in pipe_lookup 



Have a local copy of the max_rect value from the pipe so as to avoid
out of bound read access as the pipe pointer is looped in the lookup
function.

Change-Id: Icc9552eb5a4b467dc83b03c08271752618ed79c8
Signed-off-by: default avatarKalyan Thota <kalyant@codeaurora.org>
parent 6b24dd5a

drivers/video/msm/mdss/mdss_mdp_pipe.c

+3 −2
Original line number Diff line number Diff line
@@ -1338,10 +1338,11 @@ static struct mdss_mdp_pipe *__pipe_lookup(struct mdss_mdp_pipe *pipe_list, 
		bool (*cmp)(struct mdss_mdp_pipe *, void *), void *data)

{

	struct mdss_mdp_pipe *pipe;

	int i, j;

	int i, j, max_rects;



	for (i = 0, pipe = pipe_list; i < count; i++) {

		for (j = 0; j < pipe->multirect.max_rects; j++, pipe++)

		max_rects = pipe->multirect.max_rects;

		for (j = 0; j < max_rects; j++, pipe++)

			if ((rect_num == pipe->multirect.num) &&

					cmp(pipe, data))

				return pipe;