Fix the security check for framebuffer mapping.
authorcoderain <coderain@sdf.org>
Sat, 8 Sep 2018 17:57:56 +0000 (19:57 +0200)
committercoderain <coderain@sdf.org>
Sat, 8 Sep 2018 17:57:56 +0000 (19:57 +0200)
kernel/src/video.c

index 65df5492e8da7a53b628300ffc77ac4f43cac52d..bc3c0271eabbcbd5d836a46320471247f678fe97 100644 (file)
@@ -289,11 +289,7 @@ dword_t video_default_control(video_device_t *device,
             video_map_framebuffer_t *params = (video_map_framebuffer_t*)in_buffer;
             void *address = params->address;
             dword_t size = device->current_mode.height * device->current_mode.scanline_size * (device->current_mode.bpp >> 3);
-
-            if (params->offset >= size || params->size >= size || (params->offset + params->size) > size)
-            {
-                return ERR_INVALID;
-            }
+            if (params->offset >= size || params->size > size || (params->offset + params->size) > size) return ERR_INVALID;
 
             if (get_previous_mode() == USER_MODE)
             {