|
@@ -685,6 +685,17 @@ static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
|
|
fbcon_set_bitops(ops);
|
|
fbcon_set_bitops(ops);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
+
|
|
|
|
+static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
|
|
|
|
+{
|
|
|
|
+ int err = 0;
|
|
|
|
+
|
|
|
|
+ if (info->flags & FBINFO_MISC_TILEBLITTING &&
|
|
|
|
+ info->tileops->fb_get_tilemax(info) < charcount)
|
|
|
|
+ err = 1;
|
|
|
|
+
|
|
|
|
+ return err;
|
|
|
|
+}
|
|
#else
|
|
#else
|
|
static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
|
|
static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
|
|
{
|
|
{
|
|
@@ -695,6 +706,12 @@ static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
|
|
fbcon_set_rotation(info);
|
|
fbcon_set_rotation(info);
|
|
fbcon_set_bitops(ops);
|
|
fbcon_set_bitops(ops);
|
|
}
|
|
}
|
|
|
|
+
|
|
|
|
+static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
|
|
|
|
+{
|
|
|
|
+ return 0;
|
|
|
|
+}
|
|
|
|
+
|
|
#endif /* CONFIG_MISC_TILEBLITTING */
|
|
#endif /* CONFIG_MISC_TILEBLITTING */
|
|
|
|
|
|
|
|
|
|
@@ -2518,6 +2535,10 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
|
|
!(info->pixmap.blit_y & (1 << (font->height - 1))))
|
|
!(info->pixmap.blit_y & (1 << (font->height - 1))))
|
|
return -EINVAL;
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
+ /* Make sure driver can handle the font length */
|
|
|
|
+ if (fbcon_invalid_charcount(info, charcount))
|
|
|
|
+ return -EINVAL;
|
|
|
|
+
|
|
size = h * pitch * charcount;
|
|
size = h * pitch * charcount;
|
|
|
|
|
|
new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
|
|
new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
|