From 3d96b3ff4faf1e48836b696770543b0f5fef2ebb Mon Sep 17 00:00:00 2001 From: "hyesoo.yu" Date: Fri, 8 Sep 2017 14:29:16 +0900 Subject: [PATCH] [COMMON] g2d: fix out-of-bounds read Overrunning array release_fences of 17 4-byte elements at element index 4294967294 (byte offset 17179869176) using index Change-Id: I18d984096c8975fb2afc38a2785baf8e5505ca4d Signed-off-by: hyesoo.yu --- drivers/gpu/exynos/g2d/g2d_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/exynos/g2d/g2d_fence.c b/drivers/gpu/exynos/g2d/g2d_fence.c index d9f70e7ae79e..5a7138b401b8 100644 --- a/drivers/gpu/exynos/g2d/g2d_fence.c +++ b/drivers/gpu/exynos/g2d/g2d_fence.c @@ -148,7 +148,7 @@ struct sync_file *g2d_create_release_fence(struct g2d_device *g2d_dev, struct dma_fence *fence; struct sync_file *file; s32 release_fences[G2D_MAX_IMAGES + 1]; - unsigned int i; + int i; int ret = 0; if (!(task->flags & G2D_FLAG_NONBLOCK) || !data->num_release_fences) -- 2.20.1