tag 1eec9b2129e414827cba59e6a1f763fe02683a39
tagger The Android Open Source Project <initial-contribution@android.com> Tue Oct 04 17:00:33 2016 -0700
object b162aae6d2f3223e6bc971fa9fc31647b1fde08e

Android 6.0.1 Release 0.127 (MMB30Y,Nexus 6)

commit b162aae6d2f3223e6bc971fa9fc31647b1fde08e
author Naseer Ahmed <naseer@codeaurora.org> Thu Aug 04 14:25:23 2016 -0400
committer Patrick Tjin <pattjin@google.com> Wed Aug 24 13:43:03 2016 -0700
tree e9d7672a7c73023a3932ac86918adbf636e3d531
parent 11032d745836280574827bb1db5e64a94945180e

msm: mdss: Fix to validate data copied from user space

The overlay zorder values copied from user space are used
as index in left_lm_zo_cnt and right_lm_zo_cnt. This fix
will validate the overlay zorder value copied from user
space to not go beyond MDSS_MDP_MAX_STAGE, thus preventing
any arbitrary increments in kernel memory.

Bug: 30019716
CRs-Fixed: 1049232
Change-Id: Ie8e65ce9f58cb357204bfa4c6a6e0fccec82d5ba
Signed-off-by: Shalini Krishnamoorthi <shakri@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>