Merge tag 'drm-misc-fixes-2020-10-01' of git://anongit.freedesktop.org/drm/drm-misc...

[linux-2.6-microblaze.git] / drivers / video / fbdev / core / fbcon.c

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 41f3fa3..8c7bd0a 100644 (file)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2299,6 +2299,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
 
        if (font->width <= 8) {
                j = vc->vc_font.height;
+               if (font->charcount * j > FNTSIZE(fontdata))
+                       return -EINVAL;
+
                for (i = 0; i < font->charcount; i++) {
                        memcpy(data, fontdata, j);
                        memset(data + j, 0, 32 - j);
@@ -2307,6 +2310,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
                }
        } else if (font->width <= 16) {
                j = vc->vc_font.height * 2;
+               if (font->charcount * j > FNTSIZE(fontdata))
+                       return -EINVAL;
+
                for (i = 0; i < font->charcount; i++) {
                        memcpy(data, fontdata, j);
                        memset(data + j, 0, 64 - j);
@@ -2314,6 +2320,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
                        fontdata += j;
                }
        } else if (font->width <= 24) {
+               if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata))
+                       return -EINVAL;
+
                for (i = 0; i < font->charcount; i++) {
                        for (j = 0; j < vc->vc_font.height; j++) {
                                *data++ = fontdata[0];
@@ -2326,6 +2335,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
                }
        } else {
                j = vc->vc_font.height * 4;
+               if (font->charcount * j > FNTSIZE(fontdata))
+                       return -EINVAL;
+
                for (i = 0; i < font->charcount; i++) {
                        memcpy(data, fontdata, j);
                        memset(data + j, 0, 128 - j);