Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f173ec50 authored by Harsh Sahu's avatar Harsh Sahu Committed by Rajkumar Subbiah
Browse files

msm: mdss: avoid overflow in mdp clock rate calculation for rotator 



The width and height in calculation of the clk_rate comes from user.
This change checks these values against its maximum value allowed. In
case of overflow it returns immediately with invalid argument.

Change-Id: Idbf7cf0c425769ab7b672b781aa791bbfd77916d
Signed-off-by: default avatarHarsh Sahu <hsahu@codeaurora.org>
parent 8d0bafc0

drivers/video/msm/mdss/mdss_rotator.c

+8 −0
Original line number Diff line number Diff line
@@ -1034,8 +1034,16 @@ static int mdss_rotator_calc_perf(struct mdss_rot_perf *perf) 
		pr_err("invalid output format\n");

		return -EINVAL;

	}

	if (!config->input.width ||

		(0xffffffff/config->input.width < config->input.height))

		return -EINVAL;



	perf->clk_rate = config->input.width * config->input.height;



	if (!perf->clk_rate ||

		(0xffffffff/perf->clk_rate < config->frame_rate))

		return -EINVAL;



	perf->clk_rate *= config->frame_rate;

	/* rotator processes 4 pixels per clock */

	perf->clk_rate /= 4;