From patchwork Tue Jun 14 09:25:07 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Laurent Pinchart X-Patchwork-Id: 878612 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter2.kernel.org (8.14.4/8.14.4) with ESMTP id p5E9PJ0U004599 for ; Tue, 14 Jun 2011 09:25:24 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755874Ab1FNJZY (ORCPT ); Tue, 14 Jun 2011 05:25:24 -0400 Received: from perceval.ideasonboard.com ([95.142.166.194]:58401 "EHLO perceval.ideasonboard.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755467Ab1FNJZU (ORCPT ); Tue, 14 Jun 2011 05:25:20 -0400 Received: from localhost.localdomain (unknown [91.178.246.59]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 3772135B92; Tue, 14 Jun 2011 09:25:06 +0000 (UTC) From: Laurent Pinchart To: linux-fbdev@vger.kernel.org Cc: Aaro Koskinen , Arnaud Patard Subject: [PATCH v2 29/29] staging: xgifb: use display information in info not in var for panning Date: Tue, 14 Jun 2011 11:25:07 +0200 Message-Id: <1308043507-11083-30-git-send-email-laurent.pinchart@ideasonboard.com> X-Mailer: git-send-email 1.7.3.4 In-Reply-To: <1308043507-11083-1-git-send-email-laurent.pinchart@ideasonboard.com> References: <1308043507-11083-1-git-send-email-laurent.pinchart@ideasonboard.com> Sender: linux-fbdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fbdev@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Tue, 14 Jun 2011 09:25:24 +0000 (UTC) We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart Cc: Aaro Koskinen Cc: Arnaud Patard --- drivers/staging/xgifb/XGI_main_26.c | 22 ++++++---------------- 1 files changed, 6 insertions(+), 16 deletions(-) diff --git a/drivers/staging/xgifb/XGI_main_26.c b/drivers/staging/xgifb/XGI_main_26.c index cadec2a..e92f6fa 100644 --- a/drivers/staging/xgifb/XGI_main_26.c +++ b/drivers/staging/xgifb/XGI_main_26.c @@ -1365,26 +1365,16 @@ static int XGIfb_do_set_var(struct fb_var_screeninfo *var, int isactive, } #ifdef XGIFB_PAN -static int XGIfb_pan_var(struct fb_var_screeninfo *var) +static int XGIfb_pan_var(struct fb_var_screeninfo *var, struct fb_info *info) { unsigned int base; /* printk("Inside pan_var"); */ - if (var->xoffset > (var->xres_virtual - var->xres)) { - /* printk("Pan: xo: %d xv %d xr %d\n", - var->xoffset, var->xres_virtual, var->xres); */ - return -EINVAL; - } - if (var->yoffset > (var->yres_virtual - var->yres)) { - /* printk("Pan: yo: %d yv %d yr %d\n", - var->yoffset, var->yres_virtual, var->yres); */ - return -EINVAL; - } - base = var->yoffset * var->xres_virtual + var->xoffset; + base = var->yoffset * info->var.xres_virtual + var->xoffset; /* calculate base bpp dep. */ - switch (var->bits_per_pixel) { + switch (info->var.bits_per_pixel) { case 16: base >>= 1; break; @@ -1682,9 +1672,9 @@ static int XGIfb_pan_display(struct fb_var_screeninfo *var, /* printk("\nInside pan_display:\n"); */ - if (var->xoffset > (var->xres_virtual - var->xres)) + if (var->xoffset > (info->var.xres_virtual - info->var.xres)) return -EINVAL; - if (var->yoffset > (var->yres_virtual - var->yres)) + if (var->yoffset > (info->var.yres_virtual - info->var.yres)) return -EINVAL; if (var->vmode & FB_VMODE_YWRAP) { @@ -1697,7 +1687,7 @@ static int XGIfb_pan_display(struct fb_var_screeninfo *var, > info->var.yres_virtual) return -EINVAL; } - err = XGIfb_pan_var(var); + err = XGIfb_pan_var(var, info); if (err < 0) return err;