diff options
| author | Álvaro Fernández Rojas <noltari@gmail.com> | 2016-12-02 11:50:26 +0100 |
|---|---|---|
| committer | Álvaro Fernández Rojas <noltari@gmail.com> | 2016-12-04 12:32:04 +0100 |
| commit | 011f2c26f1b62e309f2eac6a3101bfe0a3c76c7e (patch) | |
| tree | be53d4f11f7625508ee3aea9889e854ab5b5f263 /target/linux/brcm2708/patches-4.4/0498-fbmem-Ensure-that-parameters-are-properly-checked-wi.patch | |
| parent | 4257f6548b9480cdb436115b63d5c134c5e91303 (diff) | |
| download | upstream-011f2c26f1b62e309f2eac6a3101bfe0a3c76c7e.tar.gz upstream-011f2c26f1b62e309f2eac6a3101bfe0a3c76c7e.tar.bz2 upstream-011f2c26f1b62e309f2eac6a3101bfe0a3c76c7e.zip | |
brcm2708: update linux 4.4 patches to latest version
As usual these patches were extracted and rebased from the raspberry pi repo:
https://github.com/raspberrypi/linux/tree/rpi-4.4.y
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Diffstat (limited to 'target/linux/brcm2708/patches-4.4/0498-fbmem-Ensure-that-parameters-are-properly-checked-wi.patch')
| -rw-r--r-- | target/linux/brcm2708/patches-4.4/0498-fbmem-Ensure-that-parameters-are-properly-checked-wi.patch | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/target/linux/brcm2708/patches-4.4/0498-fbmem-Ensure-that-parameters-are-properly-checked-wi.patch b/target/linux/brcm2708/patches-4.4/0498-fbmem-Ensure-that-parameters-are-properly-checked-wi.patch new file mode 100644 index 0000000000..4b9ee5d211 --- /dev/null +++ b/target/linux/brcm2708/patches-4.4/0498-fbmem-Ensure-that-parameters-are-properly-checked-wi.patch @@ -0,0 +1,27 @@ +From b5dd047d429d99a2e9a567d29df581e21e7ba071 Mon Sep 17 00:00:00 2001 +From: popcornmix <popcornmix@gmail.com> +Date: Wed, 7 Sep 2016 16:57:59 +0100 +Subject: [PATCH] fbmem: Ensure that parameters are properly checked within + fb_copyarea_user + +--- + drivers/video/fbdev/core/fbmem.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1090,7 +1090,13 @@ static int fb_copyarea_user(struct fb_in + int ret = 0; + if (!lock_fb_info(info)) + return -ENODEV; +- if (copy->dx + copy->width > info->var.xres || ++ if (copy->dx >= info->var.xres || ++ copy->sx >= info->var.xres || ++ copy->width > info->var.xres || ++ copy->dy >= info->var.yres || ++ copy->sy >= info->var.yres || ++ copy->height > info->var.yres || ++ copy->dx + copy->width > info->var.xres || + copy->sx + copy->width > info->var.xres || + copy->dy + copy->height > info->var.yres || + copy->sy + copy->height > info->var.yres) { |