A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 20:33:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: adsprpc: Handle out-of-bounds read in debugfs

Browse source 
Removed fixing the Title size which may not terminate
the NULL character end of Title. And, this would fix the
possible out-of-bounds read when reading debug-fs.

Change-Id: Ib3ff2b0106a25232c7a766baaaaca5bd9d306533
Acked-by: Krishnaiah Tadakamalla <ktadakam@qti.qualcomm.com>
Signed-off-by: Jeya R <jeyr@codeaurora.org>
This commit is contained in:
Jeya R 2021-05-18 09:14:08 -07:00
commit 2ef6692192
1 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
drivers/char/adsprpc.c
View file

@ -64,7 +64,6 @@
#define FASTRPC_ENOSUCH 39
#define DEBUGFS_SIZE 3072
#define UL_SIZE 25
#define PID_SIZE 10
#define AUDIO_PDR_ADSP_DTSI_PROPERTY_NAME "qcom,fastrpc-adsp-audio-pdr"
@ -5235,8 +5234,8 @@ static ssize_t fastrpc_debugfs_read(struct file *filp, char __user *buffer,
unsigned int len = 0;
int i, j, sess_used = 0, ret = 0;
char *fileinfo = NULL;
char single_line[UL_SIZE] = "----------------";
char title[UL_SIZE] = "=========================";
char single_line[] = "----------------";
char title[] = "=========================";
fileinfo = kzalloc(DEBUGFS_SIZE, GFP_KERNEL);
if (!fileinfo) {