mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-09 21:59:12 -04:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
commit 92fbb6d1296f81f41f65effd7f5f8c0f74943d15 upstream.
The data->block[0] variable comes from user and is a number between
0-255. Without proper check, the variable may be very large to cause
an out-of-bounds when performing memcpy in slimpro_i2c_blkwr.
Fix this bug by checking the value of writelen.
Fixes:
|
||
| .. | ||
| algos | ||
| busses | ||
| muxes | ||
| i2c-boardinfo.c | ||
| i2c-core-acpi.c | ||
| i2c-core-base.c | ||
| i2c-core-of.c | ||
| i2c-core-slave.c | ||
| i2c-core-smbus.c | ||
| i2c-core.h | ||
| i2c-dev.c | ||
| i2c-mux.c | ||
| i2c-slave-eeprom.c | ||
| i2c-smbus.c | ||
| i2c-stub.c | ||
| Kconfig | ||
| Makefile | ||