diff options
| author | Ingo Molnar <[email protected]> | 2018-10-09 08:50:10 +0200 |
|---|---|---|
| committer | Ingo Molnar <[email protected]> | 2018-10-09 08:50:10 +0200 |
| commit | fc8eaa85681fa72dc6a4e46f01c92e4fba83d0ab (patch) | |
| tree | b044fab426f2167ceeb37ed6fe58f7f11b10cebd /drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | |
| parent | 2cc81c6992248ea37d0241bc325977bab310bc3b (diff) | |
| parent | 49e00eee00612b1357596fed8a88b621a7648c14 (diff) | |
Merge branch 'x86/urgent' into x86/cache, to pick up dependent fix
Signed-off-by: Ingo Molnar <[email protected]>
Diffstat (limited to 'drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c')
| -rw-r--r-- | drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c index ef69273074ba..a3edb20ea4c3 100644 --- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c +++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c @@ -496,6 +496,9 @@ static int omapfb_memory_read(struct fb_info *fbi, if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size)) return -EFAULT; + if (mr->w > 4096 || mr->h > 4096) + return -EINVAL; + if (mr->w * mr->h * 3 > mr->buffer_size) return -EINVAL; @@ -509,7 +512,7 @@ static int omapfb_memory_read(struct fb_info *fbi, mr->x, mr->y, mr->w, mr->h); if (r > 0) { - if (copy_to_user(mr->buffer, buf, mr->buffer_size)) + if (copy_to_user(mr->buffer, buf, r)) r = -EFAULT; } |