From c1a05dc44ef59f5aedf4887fbe4299b54c4759ca Mon Sep 17 00:00:00 2001 From: Brett Gordon Date: Fri, 23 Oct 2015 02:18:36 -0400 Subject: [PATCH] dragon-nx32: graphics: fix bounds checking for reading/writing axis where swapped. --- Kernel/platform-dragon-nx32/devtty.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Kernel/platform-dragon-nx32/devtty.c b/Kernel/platform-dragon-nx32/devtty.c index 28d22540..1766f7f3 100644 --- a/Kernel/platform-dragon-nx32/devtty.c +++ b/Kernel/platform-dragon-nx32/devtty.c @@ -370,8 +370,8 @@ static int gfx_draw_op(uarg_t arg, char *ptr, uint8_t *buf) if (l < 8) return EINVAL; l -= 8; - if (p[0] > 31 || p[1] > 191 || p[2] > 31 || p[3] > 191 || - p[0] + p[2] > 32 || p[1] + p[3] > 192 || + if (p[0] > 191 || p[1] > 31 || p[2] > 191 || p[3] > 31 || + p[0] + p[2] > 192 || p[1] + p[3] > 32 || (p[2] * p[3]) > l) return -EFAULT; if (arg == GFXIOC_READ) { -- 2.34.1