Skip to content
Snippets Groups Projects
Commit e3aab32a authored by Diego Wilson's avatar Diego Wilson Committed by Gerrit - the friendly Code Review server
Browse files

Add sanity checks of input of mdp_ppp_solid_fill() 

Change-Id: I7a9341fe9a24b39e36f43e32cf7fbb8c9607994d
parent 7c5b2338
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
patch/ics_chocolate/kernel/kernel-add-fillcolor.patch
+ 15
− 3
View file @ e3aab32a
diff --git a/drivers/video/msm/mdp_ppp.c b/drivers/video/msm/mdp_ppp.c
index a6f03ba..60504a0 100644
index a6f03ba..2100001 100644
--- a/drivers/video/msm/mdp_ppp.c
+++ b/drivers/video/msm/mdp_ppp.c
@@ -1313,40 +1313,183 @@ void put_img(struct file *p_src_file)
@@ -1313,40 +1313,195 @@ void put_img(struct file *p_src_file)
#endif
}
......@@ -20,6 +20,18 @@ index a6f03ba..60504a0 100644
+ struct msm_fb_data_type *mfd = info->par;
+ dest1 = NULL;
+
+ if (req == NULL) {
+ printk(KERN_ERR "mdp_ppp_solid_fill: null request!\n");
+ return -EINVAL;
+ }
+
+ if ((req->dst_rect.x < 0) || (req->dst_rect.y < 0) ||
+ (req->dst_rect.w > req->dst.width) ||
+ (req->dst_rect.h > req->dst.height)) {
+ printk(KERN_ERR "mdp_ppp_solid_fill: Invalid dst rect!\n");
+ return -EINVAL;
+ }
+
+ down(&mdp_ppp_mutex);
+ mdp_pipe_ctrl(MDP_CMD_BLOCK, MDP_BLOCK_POWER_ON, FALSE);
+ req->dst_rect.w = ((req->dst_rect.w/2) * 2);
......@@ -211,7 +223,7 @@ index a6f03ba..60504a0 100644
if (mdp_ppp_verify_req(req)) {
printk(KERN_ERR "mdp_ppp: invalid image!\n");
put_img(p_src_file);
@@ -1589,3 +1732,40 @@ int mdp_ppp_blit(struct fb_info *info, struct mdp_blit_req *req)
@@ -1589,3 +1744,40 @@ int mdp_ppp_blit(struct fb_info *info, struct mdp_blit_req *req)
put_img(p_dst_file);
return 0;
}
......
patch/ics_strawberry/kernel/kernel-add-fillcolor.patch
+ 17
− 5
View file @ e3aab32a
diff --git a/drivers/video/msm/mdp_ppp.c b/drivers/video/msm/mdp_ppp.c
index 4009ffc..2bd09db 100644
index 91fa68f..f5e843c 100644
--- a/drivers/video/msm/mdp_ppp.c
+++ b/drivers/video/msm/mdp_ppp.c
@@ -1572,6 +1572,167 @@ static int mdp_ppp_blit_addr(struct fb_info *info, struct mdp_blit_req *req,
@@ -1572,6 +1572,179 @@ static int mdp_ppp_blit_addr(struct fb_info *info, struct mdp_blit_req *req,
return 0;
}
......@@ -20,6 +20,18 @@ index 4009ffc..2bd09db 100644
+ struct msm_fb_data_type *mfd = info->par;
+ dest1 = NULL;
+
+ if (req == NULL) {
+ printk(KERN_ERR "mdp_ppp_solid_fill: null request!\n");
+ return -EINVAL;
+ }
+
+ if ((req->dst_rect.x < 0) || (req->dst_rect.y < 0) ||
+ (req->dst_rect.w > req->dst.width) ||
+ (req->dst_rect.h > req->dst.height)) {
+ printk(KERN_ERR "mdp_ppp_solid_fill: Invalid dst rect!\n");
+ return -EINVAL;
+ }
+
+ down(&mdp_ppp_mutex);
+ mdp_pipe_ctrl(MDP_CMD_BLOCK, MDP_BLOCK_POWER_ON, FALSE);
+ req->dst_rect.w = ((req->dst_rect.w/2) * 2);
......@@ -170,7 +182,7 @@ index 4009ffc..2bd09db 100644
int mdp_ppp_blit(struct fb_info *info, struct mdp_blit_req *req)
{
unsigned long src_start, dst_start;
@@ -1579,14 +1740,16 @@ int mdp_ppp_blit(struct fb_info *info, struct mdp_blit_req *req)
@@ -1579,14 +1752,16 @@ int mdp_ppp_blit(struct fb_info *info, struct mdp_blit_req *req)
unsigned long dst_len = 0;
struct file *p_src_file = 0 , *p_dst_file = 0;
......@@ -194,7 +206,7 @@ index 4009ffc..2bd09db 100644
}
if (req->flags & MDP_BLIT_DST_GEM)
get_gem_img(&req->dst, &dst_start, &dst_len);
@@ -1599,6 +1762,10 @@ int mdp_ppp_blit(struct fb_info *info, struct mdp_blit_req *req)
@@ -1599,6 +1774,10 @@ int mdp_ppp_blit(struct fb_info *info, struct mdp_blit_req *req)
return -EINVAL;
}
......@@ -206,7 +218,7 @@ index 4009ffc..2bd09db 100644
dst_len, p_src_file, p_dst_file);
}
diff --git a/include/linux/msm_mdp.h b/include/linux/msm_mdp.h
index 12307e0..fab40ab 100644
index 69bed10..be40938 100644
--- a/include/linux/msm_mdp.h
+++ b/include/linux/msm_mdp.h
@@ -124,6 +124,7 @@ enum {
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment