diff options
| author | Robby Cai <robby.cai@nxp.com> | 2019-04-28 16:28:47 +0800 |
|---|---|---|
| committer | Robby Cai <robby.cai@nxp.com> | 2019-05-06 11:19:00 +0800 |
| commit | 1b54ea4d98d0a78dbd9202d91b9ec209f4f5a9b8 (patch) | |
| tree | 3fc30fba0e0f08717f44ca6c25a3d01ef16fa550 /drivers | |
| parent | 39dc0aaffe5a7499b0d3ceb594782e7c4082b90f (diff) | |
MLK-21590 epdc: fix potential out of array boundary access
The function mxc_epdc_fb_init_hw() could be called more than once when load
the firmware due to some reason. If this case happens, then for following codes,
the array fb_data->fw_str pointed to will be accessed out of bound. It probably
causes kernel crash, or makes fb_data->fw_str get a wrong value, then the driver
may be stuck during the process of loading the firmware.
if (fb_data->cur_mode) {
strcat(fb_data->fw_str, "imx/epdc/epdc_");
strcat(fb_data->fw_str, fb_data->cur_mode->vmode->name);
strcat(fb_data->fw_str, ".fw");
}
This patch fixed that by using strcpy instread.
Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.Zhou <guoniu.zhou@nxp.com>
(cherry picked from commit 9d07c19d01a97ca7e5570a1cd4681ad600d0486e)
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/fbdev/mxc/mxc_epdc_fb.c | 2 | ||||
| -rw-r--r-- | drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/video/fbdev/mxc/mxc_epdc_fb.c b/drivers/video/fbdev/mxc/mxc_epdc_fb.c index 0109b0371b76..49a0d6e519b9 100644 --- a/drivers/video/fbdev/mxc/mxc_epdc_fb.c +++ b/drivers/video/fbdev/mxc/mxc_epdc_fb.c @@ -4424,7 +4424,7 @@ static int mxc_epdc_fb_init_hw(struct fb_info *info) * Format is "imx/epdc_[panel string].fw" */ if (fb_data->cur_mode) { - strcat(fb_data->fw_str, "imx/epdc/epdc_"); + strcpy(fb_data->fw_str, "imx/epdc/epdc_"); strcat(fb_data->fw_str, fb_data->cur_mode->vmode->name); strcat(fb_data->fw_str, ".fw"); } diff --git a/drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c b/drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c index cd8d49adbf14..9ec89d033a82 100644 --- a/drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c +++ b/drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c @@ -4854,7 +4854,7 @@ static int mxc_epdc_fb_init_hw(struct fb_info *info) * Format is "imx/epdc/epdc_[panel string].fw" */ if (fb_data->cur_mode) { - strcat(fb_data->fw_str, "imx/epdc/epdc_"); + strcpy(fb_data->fw_str, "imx/epdc/epdc_"); strcat(fb_data->fw_str, fb_data->cur_mode->vmode->name); strcat(fb_data->fw_str, ".fw"); } |