1 files changed, 4 insertions, 1 deletions

diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
index ef69273074ba..a3edb20ea4c3 100644
--- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
@@ -496,6 +496,9 @@ static int omapfb_memory_read(struct fb_info *fbi,
         if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size))
                 return -EFAULT;
 
+        if (mr->w > 4096 || mr->h > 4096)
+                return -EINVAL;
+
         if (mr->w * mr->h * 3 > mr->buffer_size)
                 return -EINVAL;
 
@@ -509,7 +512,7 @@ static int omapfb_memory_read(struct fb_info *fbi,
                         mr->x, mr->y, mr->w, mr->h);
 
         if (r > 0) {
-                if (copy_to_user(mr->buffer, buf, mr->buffer_size))
+                if (copy_to_user(mr->buffer, buf, r))
                         r = -EFAULT;
         }