diff options
| author | raghavendra ambadas <rambad@codeaurora.org> | 2019-05-22 17:14:21 +0530 |
|---|---|---|
| committer | raghavendra ambadas <rambad@codeaurora.org> | 2019-05-28 11:54:47 +0530 |
| commit | 01fcd88c0f94f0e18b6a482de5ba17e7fa331291 (patch) | |
| tree | 82c497c557f7f497b02af92d71b9787db409b055 /lib/mpi/mpi-inline.h | |
| parent | 14ff0dc12ed0f303ca432174d0c5b142a0299172 (diff) | |
fbdev: msm: check the length of the external input buffer properly
dchdr->dlen is a short variable controlled by the user-provided data.
If the value is negative, loop continues, also increasing the value
of "len". As a result buffer overflow occurs. So define the len as
unsigned and check with length of string input from user space.
Change-Id: I8bb9ab33d543c826eb330e16ae116385d823ca98
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
Diffstat (limited to 'lib/mpi/mpi-inline.h')
0 files changed, 0 insertions, 0 deletions