Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

fbmem: Check failure of FBIOPUTCMAP ioctl

Browse source 
On FBIOPUTCMAP ioctl failure deallocate
fb cmap. Put null check for cmap red, green,
blue component.

Change-Id: I10468ee30d0e76c256cf3d7a6ffe14db7fd4511b
Signed-off-by: Pawan Kumar <pavaku@codeaurora.org>
This commit is contained in:
Pawan Kumar 2013-10-31 16:19:44 +05:30 committed by Simon Shields
parent 1197f828df
commit 423ee25484
2 changed files with 25 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
drivers/video/fbcmap.c
View file

@ -166,6 +166,9 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
int tooff = 0, fromoff = 0;
int size;
if (!to || !from)
return -EINVAL;
if (to->start > from->start)
fromoff = to->start - from->start;
else
@ -177,9 +180,12 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
return -EINVAL;
size *= sizeof(u16);
memcpy(to->red+tooff, from->red+fromoff, size);
memcpy(to->green+tooff, from->green+fromoff, size);
memcpy(to->blue+tooff, from->blue+fromoff, size);
if (from->red && to->red)
memcpy(to->red+tooff, from->red+fromoff, size);
if (from->green && to->green)
memcpy(to->green+tooff, from->green+fromoff, size);
if (from->blue && to->blue)
memcpy(to->blue+tooff, from->blue+fromoff, size);
if (from->transp && to->transp)
memcpy(to->transp+tooff, from->transp+fromoff, size);
return 0;
@ -190,6 +196,9 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
int tooff = 0, fromoff = 0;
int size;
if (!to || !from)
return -EINVAL;
if (to->start > from->start)
fromoff = to->start - from->start;
else
@ -203,12 +212,15 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
size = from->len - fromoff;
size *= sizeof(u16);
if (copy_to_user(to->red+tooff, from->red+fromoff, size))
return -EFAULT;
if (copy_to_user(to->green+tooff, from->green+fromoff, size))
return -EFAULT;
if (copy_to_user(to->blue+tooff, from->blue+fromoff, size))
return -EFAULT;
if (from->red && to->red)
if (copy_to_user(to->red+tooff, from->red+fromoff, size))
return -EFAULT;
if (from->green && to->green)
if (copy_to_user(to->green+tooff, from->green+fromoff, size))
return -EFAULT;
if (from->blue && to->blue)
if (copy_to_user(to->blue+tooff, from->blue+fromoff, size))
return -EFAULT;
if (from->transp && to->transp)
if (copy_to_user(to->transp+tooff, from->transp+fromoff, size))
return -EFAULT;

4
drivers/video/fbmem.c
View file

@ -1113,6 +1113,10 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
if (copy_from_user(&cmap, argp, sizeof(cmap)))
return -EFAULT;
ret = fb_set_user_cmap(&cmap, info);
if (ret) {
if (info)
fb_dealloc_cmap(&info->cmap);
}
break;
case FBIOGETCMAP:
if (copy_from_user(&cmap, argp, sizeof(cmap)))