From: Krzysztof Kozlowski k.kozlowski@samsung.com

Valid values for FIMD windows are from 0 to WINDOWS_NR-1 inclusive (5 windows in total). The WINDOWS_NR is also a size of fimd_context.win_data array. However, early-return tests for wrong values of windows accepted a value of WINDOWS_NR which is out of bound for fimd_context.win_data.

Signed-off-by: Krzysztof Kozlowski k.kozlowski@samsung.com Signed-off-by: Inki Dae inki.dae@samsung.com --- drivers/gpu/drm/exynos/exynos_drm_fimd.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c index 97c61db..279c3f8 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c +++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c @@ -381,7 +381,7 @@ static void fimd_win_mode_set(struct device *dev, if (win == DEFAULT_ZPOS) win = ctx->default_win;

- if (win < 0 || win > WINDOWS_NR) + if (win < 0 || win >= WINDOWS_NR) return;

offset = overlay->fb_x * (overlay->bpp >> 3); @@ -506,7 +506,7 @@ static void fimd_win_commit(struct device *dev, int zpos) if (win == DEFAULT_ZPOS) win = ctx->default_win;

- if (win < 0 || win > WINDOWS_NR) + if (win < 0 || win >= WINDOWS_NR) return;

win_data = &ctx->win_data[win]; @@ -622,7 +622,7 @@ static void fimd_win_disable(struct device *dev, int zpos) if (win == DEFAULT_ZPOS) win = ctx->default_win;

- if (win < 0 || win > WINDOWS_NR) + if (win < 0 || win >= WINDOWS_NR) return;

win_data = &ctx->win_data[win];