diff options
| author | Mister Oyster <oysterized@gmail.com> | 2017-08-11 15:22:06 +0200 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-08-11 16:05:43 +0200 |
| commit | 8d46dae27f18f37f855aaa02e845e86a439f5dc7 (patch) | |
| tree | 51db4c2f821e852b0ef36701bb65b3017954dc88 | |
| parent | 1849f167e74700861f36db9380c2e695cdb5b925 (diff) | |
mtk: gud: upstream update (up to ~june 17)
| -rw-r--r-- | drivers/misc/mediatek/gpu/ged/src/ged_main.c | 17 |
1 files changed, 12 insertions, 5 deletions
diff --git a/drivers/misc/mediatek/gpu/ged/src/ged_main.c b/drivers/misc/mediatek/gpu/ged/src/ged_main.c index eff199d18..593d6d4a6 100644 --- a/drivers/misc/mediatek/gpu/ged/src/ged_main.c +++ b/drivers/misc/mediatek/gpu/ged/src/ged_main.c @@ -84,14 +84,21 @@ static long ged_dispatch(GED_BRIDGE_PACKAGE *psBridgePackageKM) { int ret = -EFAULT; void *pvInt, *pvOut; - typedef int (ged_bridge_func_type)(void*, void*); + typedef int (ged_bridge_func_type)(void *, void *); ged_bridge_func_type* pFunc = NULL; - - if ((psBridgePackageKM->i32InBufferSize >=0) && (psBridgePackageKM->i32OutBufferSize >=0) && - (psBridgePackageKM->i32InBufferSize + psBridgePackageKM->i32OutBufferSize < GED_IOCTL_PARAM_BUF_SIZE)) + + /* We make sure the both size and the sum of them are GE 0 integer. + * The sum will not overflow to zero, because we will get zero from two GE 0 integers + * if and only if they are both zero in a 2's complement numeral system. + * That is: if overflow happen, the sum will be a negative number. + */ + if (psBridgePackageKM->i32InBufferSize >= 0 && psBridgePackageKM->i32OutBufferSize >= 0 + && psBridgePackageKM->i32InBufferSize + psBridgePackageKM->i32OutBufferSize >= 0 + && psBridgePackageKM->i32InBufferSize + psBridgePackageKM->i32OutBufferSize + < GED_IOCTL_PARAM_BUF_SIZE) { pvInt = gvIOCTLParamBuf; - pvOut = (void*)((char*)pvInt + (uintptr_t)psBridgePackageKM->i32InBufferSize); + pvOut = (void *)((char *)pvInt + (uintptr_t)psBridgePackageKM->i32InBufferSize); if (psBridgePackageKM->i32InBufferSize > 0) { if (0 != ged_copy_from_user(pvInt, psBridgePackageKM->pvParamIn, psBridgePackageKM->i32InBufferSize)) |