Skip to content

Commit

Permalink
atafb: test virtual screen range before subtraction on unsigned
Browse files Browse the repository at this point in the history
dx and dy are u32's, so the test should occur before the subtraction

Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
Cc: Tim Schmielau <tim@physik3.uni-rostock.de>
Cc: Krzysztof Helt <krzysztof.h1@wp.pl>
Cc: Antonino Daplas <adaplas@pol.net>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  • Loading branch information
Roel Kluin authored and Linus Torvalds committed Jul 24, 2008
1 parent 091c82c commit 1c0face
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions drivers/video/atafb.c
Original file line number Diff line number Diff line change
Expand Up @@ -2593,13 +2593,16 @@ static void atafb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
width = x2 - dx;
height = y2 - dy;

if (area->sx + dx < area->dx || area->sy + dy < area->dy)
return;

/* update sx,sy */
sx = area->sx + (dx - area->dx);
sy = area->sy + (dy - area->dy);

/* the source must be completely inside the virtual screen */
if (sx < 0 || sy < 0 || (sx + width) > info->var.xres_virtual ||
(sy + height) > info->var.yres_virtual)
if (sx + width > info->var.xres_virtual ||
sy + height > info->var.yres_virtual)
return;

if (dy > sy || (dy == sy && dx > sx)) {
Expand Down

0 comments on commit 1c0face

Please sign in to comment.