diff options
| author | Otavio Salvador <otavio@ossystems.com.br> | 2018-12-12 11:20:31 -0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-12-12 11:20:31 -0200 |
| commit | 1e71d8c630cbc0d1f5d762fd019690b5cdb880ae (patch) | |
| tree | 58b4b37bed385b27fc5956435b2451c760f26f5f /drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | |
| parent | 5f3fecbc0715a70437501e1d85e74726c4f561be (diff) | |
| parent | cfbbc7703fff59c67761c93a8b1de29a79f9841c (diff) | |
Merge pull request #40 from toradex/4.9-2.3.x-imx
4.9 2.3.x imx
Diffstat (limited to 'drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c')
| -rw-r--r-- | drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c index ef69273074ba..a3edb20ea4c3 100644 --- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c +++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c @@ -496,6 +496,9 @@ static int omapfb_memory_read(struct fb_info *fbi, if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size)) return -EFAULT; + if (mr->w > 4096 || mr->h > 4096) + return -EINVAL; + if (mr->w * mr->h * 3 > mr->buffer_size) return -EINVAL; @@ -509,7 +512,7 @@ static int omapfb_memory_read(struct fb_info *fbi, mr->x, mr->y, mr->w, mr->h); if (r > 0) { - if (copy_to_user(mr->buffer, buf, mr->buffer_size)) + if (copy_to_user(mr->buffer, buf, r)) r = -EFAULT; } |