From 347f60d1fa19eef0a06cb7c1cdc3826abb2d86d3 Mon Sep 17 00:00:00 2001
From: Naseer Ahmed <naseer@codeaurora.org>
Date: Wed, 21 Jan 2015 18:41:26 -0500
Subject: [PATCH] msm: mdp: Validate input arguments from user space
Fully verify the input arguments from user client are safe
to use.
Change-Id: Ie14332443b187951009c63ebfb78456dcd9ba60f
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Bug: 19091590
---
drivers/video/msm/mdp.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/video/msm/mdp.c b/drivers/video/msm/mdp.c
index a9e9af582ea5..7fc0258acd2a 100644
--- a/drivers/video/msm/mdp.c
+++ b/drivers/video/msm/mdp.c
@@ -559,6 +559,11 @@ static int mdp_lut_hw_update(struct fb_cmap *cmap)
c[1] = cmap->blue;
c[2] = cmap->red;
+ if (cmap->start > MDP_HIST_LUT_SIZE || cmap->len > MDP_HIST_LUT_SIZE ||
+ (cmap->start + cmap->len > MDP_HIST_LUT_SIZE)) {
+ pr_err("mdp_lut_hw_update invalid arguments\n");
+ return -EINVAL;
+ }
for (i = 0; i < cmap->len; i++) {
if (copy_from_user(&r, cmap->red++, sizeof(r)) ||
copy_from_user(&g, cmap->green++, sizeof(g)) ||
--
GitLab