diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-11-17 11:21:49 -0500 |
---|---|---|
committer | Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> | 2017-11-17 11:21:49 -0500 |
commit | 5f215d252496543ba22299bccef5062d30d63cfe (patch) | |
tree | a991f9862eb12e91ded049f2059a894f4eeb785d | |
parent | 5fa1f45de8fd697d9f23050e20dd65c0998e6107 (diff) |
OMAPFB: prevent buffer underflow in omapfb_parse_vram_param()
We cap the upper bound of "fbnum" but we also need to check for
negatives or make the type unsigned.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
-rw-r--r-- | drivers/video/fbdev/omap2/omapfb/omapfb-main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-main.c b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c index 1d7c012f09db..e08e5664e330 100644 --- a/drivers/video/fbdev/omap2/omapfb/omapfb-main.c +++ b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c | |||
@@ -1477,7 +1477,7 @@ static int omapfb_alloc_fbmem_display(struct fb_info *fbi, unsigned long size, | |||
1477 | static int omapfb_parse_vram_param(const char *param, int max_entries, | 1477 | static int omapfb_parse_vram_param(const char *param, int max_entries, |
1478 | unsigned long *sizes, unsigned long *paddrs) | 1478 | unsigned long *sizes, unsigned long *paddrs) |
1479 | { | 1479 | { |
1480 | int fbnum; | 1480 | unsigned int fbnum; |
1481 | unsigned long size; | 1481 | unsigned long size; |
1482 | unsigned long paddr = 0; | 1482 | unsigned long paddr = 0; |
1483 | char *p, *start; | 1483 | char *p, *start; |