disp: msm: add check for buffer length before copy

Length of the buffer to be copied is checked
against both source and destination buffer lengths
before copying. This ensures that there is  no
buffer overflow while reading as well as writing.

Change-Id: I4bd1a5892b47771aef4c23a4d1594fc1c8361577
Signed-off-by: Satya Rama Aditya Pinapala <psraditya30@codeaurora.org>

msm/sde_rsc.c

@@ -1105,7 +1105,10 @@ end:
 	if (blen <= 0)
 		return 0;
 
-	blen = min_t(size_t, MAX_BUFFER_SIZE, count);
+	if (blen > count)
+		blen = count;
+
+	blen = min_t(size_t, blen, MAX_BUFFER_SIZE);
 	if (copy_to_user(buf, buffer, blen))
 		return -EFAULT;
 
@@ -1199,7 +1202,10 @@ end:
 	if (blen <= 0)
 		return 0;
 
-	blen = min_t(size_t, MAX_BUFFER_SIZE, count);
+	if (blen > count)
+		blen = count;
+
+	blen = min_t(size_t, blen, MAX_BUFFER_SIZE);
 	if (copy_to_user(buf, buffer, blen))
 		return -EFAULT;