redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity

MLK-20318 gpu: imx: dpu: scaler: Avoid out-of-bounds array read on src_sels[i][j] 

The logic in function h/vscaler_pixengcfg_dynamic_src_sel() to avoid
overrunning array src_sel[i][j] is wrong.  The correct one is to check
on the index i which should be less than the array size of h/vs_id_array[].
This patch fixes the potential array overrunning issue, that is,
out-of-bounds array read issue.  The issue is reported by coverity -
CID 1477349 and CID 1477345.

Signed-off-by: Liu Ying <victor.liu@nxp.com>
pull/10/head
Liu Ying 2018-11-12 11:18:50 +08:00
parent 6d8398135f
commit 95bc1eb150
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/imx/dpu/dpu-hscaler.c
View File

@ -105,7 +105,7 @@ int hscaler_pixengcfg_dynamic_src_sel(struct dpu_hscaler *hs, hs_src_sel_t src)
if (hs_id_array[i] == hs->id)
break;
if (WARN_ON(i == (ARRAY_SIZE(hs_id_array) + 1)))
if (WARN_ON(i == ARRAY_SIZE(hs_id_array)))
return -EINVAL;
mutex_lock(&hs->mutex);

2
drivers/gpu/imx/dpu/dpu-vscaler.c
View File

@ -108,7 +108,7 @@ int vscaler_pixengcfg_dynamic_src_sel(struct dpu_vscaler *vs, vs_src_sel_t src)
if (vs_id_array[i] == vs->id)
break;
if (WARN_ON(i == (ARRAY_SIZE(vs_id_array) + 1)))
if (WARN_ON(i == ARRAY_SIZE(vs_id_array)))
return -EINVAL;
mutex_lock(&vs->mutex);