diff options
| author | Colin Patrick McCabe <cmccabe@nvidia.com> | 2011-11-09 16:45:59 -0800 |
|---|---|---|
| committer | Dan Willemsen <dwillemsen@nvidia.com> | 2011-11-30 21:49:58 -0800 |
| commit | b855d8cbdc421bf1e9b4eeb7b394d183d3ad881e (patch) | |
| tree | abdcb78988c51d6c6c5f1854e34f8a238723f3bc /drivers | |
| parent | 539895e0bdca4d9778ca6def70ae66957573d4ea (diff) | |
video:fix buffer overflow in nvsd_lut_store
Change-Id: Iecd4b7a950c2276c2281d19a8a554b15c3dc0d16
Signed-off-by: Colin Patrick McCabe <cmccabe@nvidia.com>
Reviewed-on: http://git-master/r/63676
Reviewed-by: Jon Mayo <jmayo@nvidia.com>
Rebase-Id: Rdbc1fd6cb524b2578be33b3a9147b4078c849290
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/tegra/dc/nvsd.c | 18 |
1 files changed, 8 insertions, 10 deletions
diff --git a/drivers/video/tegra/dc/nvsd.c b/drivers/video/tegra/dc/nvsd.c index d477dc7657ec..3d1732b253cb 100644 --- a/drivers/video/tegra/dc/nvsd.c +++ b/drivers/video/tegra/dc/nvsd.c @@ -663,8 +663,8 @@ static int nvsd_lut_store(struct tegra_dc_sd_settings *sd_settings, static int nvsd_bltf_store(struct tegra_dc_sd_settings *sd_settings, const char *buf) { - int ele[4 * DC_DISP_SD_BL_TF_NUM]; - int i = 0, j = 0, num = 4 * DC_DISP_SD_BL_TF_NUM; + int ele[4 * DC_DISP_SD_BL_TF_NUM * NUM_BIN_WIDTHS]; + int i = 0, j = 0, num = ARRAY_SIZE(ele); nvsd_get_multi(ele, num, i, 0, 255); @@ -673,14 +673,12 @@ static int nvsd_bltf_store(struct tegra_dc_sd_settings *sd_settings, for (i = 0; i < NUM_BIN_WIDTHS; i++) { for (j = 0; j < DC_DISP_SD_BL_TF_NUM; j++) { - sd_settings->bltf[i][j][0] = - ele[i * NUM_BIN_WIDTHS + j * 4 + 0]; - sd_settings->bltf[i][j][1] = - ele[i * NUM_BIN_WIDTHS + j * 4 + 1]; - sd_settings->bltf[i][j][2] = - ele[i * NUM_BIN_WIDTHS + j * 4 + 2]; - sd_settings->bltf[i][j][3] = - ele[i * NUM_BIN_WIDTHS + j * 4 + 3]; + size_t base = (i * NUM_BIN_WIDTHS * + DC_DISP_SD_BL_TF_NUM) + (j * 4); + sd_settings->bltf[i][j][0] = ele[base + 0]; + sd_settings->bltf[i][j][1] = ele[base + 1]; + sd_settings->bltf[i][j][2] = ele[base + 2]; + sd_settings->bltf[i][j][3] = ele[base + 3]; } } |