diff options
| author | Udaya Bhaskara Reddy Mallavarapu <udaym@codeaurora.org> | 2017-09-05 12:01:41 +0530 |
|---|---|---|
| committer | Udaya Bhaskara Reddy Mallavarapu <udaym@codeaurora.org> | 2017-09-05 15:05:01 +0530 |
| commit | bbacde467c57fea08bdb097dffce05e956fa6f43 (patch) | |
| tree | 7f29c5fd5004fcea609ee651b521527ac1186162 /drivers | |
| parent | d727a95d2e023f5557e893aaf50a75d144f4a71e (diff) | |
drivers: media: broadcast: Fix security vulnerability issue
Information leak issue is reported in mpq_sdmx_log_level_write
function. Added check to validate count is not zero and initialize
the string.
Change-Id: Ieb2ed88c2d7d778c56be2ec3b9875270a9c74dce
Signed-off-by: Udaya Bhaskara Reddy Mallavarapu <udaym@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c b/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c index 2d2296893140..9f3e2cc3a72f 100644 --- a/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c +++ b/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c @@ -523,13 +523,17 @@ static ssize_t mpq_sdmx_log_level_write(struct file *fp, int level; struct mpq_demux *mpq_demux = fp->private_data; - if (count >= 16) + if (count == 0 || count >= 16) return -EINVAL; - ret_count = simple_write_to_buffer(user_str, 16, position, user_buffer, + memset(user_str, '\0', sizeof(user_str)); + + ret_count = simple_write_to_buffer(user_str, 15, position, user_buffer, count); if (ret_count < 0) return ret_count; + else if (ret_count == 0) + return -EINVAL; ret = kstrtoint(user_str, 0, &level); if (ret) |