From 317d656091ae6e1c0c6d752f64c640c55b07c4d1 Mon Sep 17 00:00:00 2001
From: Johannes Stezenbach <devnull@localhost>
Date: Sun, 13 Jun 2004 16:20:50 +0000
Subject: add missing get_user() calls for OSD_SetPalette; fix based on patch
 by Pekka Pietikainen

---
 linux/drivers/media/dvb/ttpci/av7110_hw.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

(limited to 'linux/drivers')

diff --git a/linux/drivers/media/dvb/ttpci/av7110_hw.c b/linux/drivers/media/dvb/ttpci/av7110_hw.c
index 5992ac71f..a1093ae04 100644
--- a/linux/drivers/media/dvb/ttpci/av7110_hw.c
+++ b/linux/drivers/media/dvb/ttpci/av7110_hw.c
@@ -870,12 +870,16 @@ static int OSDSetPalette(struct av7110 *av7110, u32 *colors, u8 first, u8 last)
        int length = last - first + 1;
 
        if (length * 4 > DATA_BUFF3_SIZE)
-	       return -1;
+	       return -EINVAL;
 
        for (i = 0; i < length; i++) {
-	       u32 blend = (colors[i] & 0xF0000000) >> 4;
-	       u32 yuv = blend ? RGB2YUV(colors[i] & 0xFF, (colors[i] >> 8) & 0xFF,
-					 (colors[i] >> 16) & 0xFF) | blend : 0;
+	       u32 color, blend, yuv;
+
+	       if (get_user(color, colors + i))
+		   return -EFAULT;
+	       blend = (color & 0xF0000000) >> 4;
+	       yuv = blend ? RGB2YUV(color & 0xFF, (color >> 8) & 0xFF,
+					 (color >> 16) & 0xFF) | blend : 0;
 	       yuv = ((yuv & 0xFFFF0000) >> 16) | ((yuv & 0x0000FFFF) << 16);
 	       wdebi(av7110, DEBINOSWAP, DATA_BUFF3_BASE + i * 4, yuv, 4);
        }
@@ -953,15 +957,20 @@ int av7110_osd_cmd(struct av7110 *av7110, osd_cmd_t *dc)
 	case OSD_SetPalette:
 	{
 		if (FW_VERSION(av7110->arm_app) >= 0x2618)
-			OSDSetPalette(av7110, (u32 *)dc->data, dc->color, dc->x0);
+			return OSDSetPalette(av7110, (u32 *)dc->data, dc->color, dc->x0);
 		else {
 			int i, len = dc->x0-dc->color+1;
 			u8 *colors = (u8 *)dc->data;
-
-			for (i = 0; i<len; i++)
-				OSDSetColor(av7110, dc->color + i,
-					colors[i * 4], colors[i * 4 + 1],
-					colors[i * 4 + 2], colors[i * 4 + 3]);
+			u8 r, g, b, blend;
+
+			for (i = 0; i<len; i++) {
+				if (get_user(r, colors + i * 4) ||
+				    get_user(g, colors + i * 4 + 1) ||
+				    get_user(b, colors + i * 4 + 2) ||
+				    get_user(blend, colors + i * 4 + 3))
+					return -EFAULT;
+				OSDSetColor(av7110, dc->color + i, r, g, b, blend);
+			}
 		}
 		return 0;
 	}
-- 
cgit v1.2.3