Merge "msm: mdss: Validate cursor image size" (f92a96af) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/video/msm/mdss/mdss_mdp_overlay.c

+7 −1

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -4723,6 +4723,12 @@ static int mdss_mdp_hw_cursor_pipe_update(struct msm_fb_data_type *mfd,
		req->transp_mask = img->bg_color & ~(0xff << var->transp.offset);

		if (mfd->cursor_buf && (cursor->set & FB_CUR_SETIMAGE)) {
		if (img->width * img->height * 4 > cursor_frame_size) {
		pr_err("cursor image size is too large\n");
		ret = -EINVAL;
		goto done;
		}

		ret = copy_from_user(mfd->cursor_buf, img->data,
		img->width * img->height * 4);
		if (ret) {