Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d958e44a authored by Naseer Ahmed's avatar Naseer Ahmed
Browse files

video: fbdev: Additional param checks on user space cmap 



Additional bound checks for parameters that are used
to calculate target buffer address.

Change-Id: Ib4a00a51c761dc7751a19e6ee7f55cacac97860f
Signed-off-by: default avatarNaseer Ahmed <naseer@codeaurora.org>
parent 63bc4524

drivers/video/fbdev/core/fbcmap.c

+3 −2
Original line number Diff line number Diff line
@@ -194,11 +194,12 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) 
		fromoff = to->start - from->start;

	else

		tooff = from->start - to->start;

	if ((to->len <= tooff) || (from->len <= fromoff))

		return -EINVAL;



	size = to->len - tooff;

	if (size > (int) (from->len - fromoff))

		size = from->len - fromoff;

	if (size <= 0)

		return -EINVAL;

	size *= sizeof(u16);



	if (copy_to_user(to->red+tooff, from->red+fromoff, size))