fbmem: Ensure that parameters are properly checked within fb_copyarea…

…_user
raspberrypi · Sep 7, 2016 · a9d3875 · a9d3875
1 parent 5da9be8
commit a9d3875
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
@@ -1090,7 +1090,13 @@ static int fb_copyarea_user(struct fb_info *info,
 	int ret = 0;
 	if (!lock_fb_info(info))
 		return -ENODEV;
-	if (copy->dx + copy->width > info->var.xres ||
+	if (copy->dx >= info->var.xres ||
+	    copy->sx >= info->var.xres ||
+	    copy->width > info->var.xres ||
+	    copy->dy >= info->var.yres ||
+	    copy->sy >= info->var.yres ||
+	    copy->height > info->var.yres ||
+	    copy->dx + copy->width > info->var.xres ||
 	    copy->sx + copy->width > info->var.xres ||
 	    copy->dy + copy->height > info->var.yres ||
 	    copy->sy + copy->height > info->var.yres) {