diff options
| author | Senthil Kumar Rajagopal <skrajago@codeaurora.org> | 2017-04-10 15:11:14 +0530 |
|---|---|---|
| committer | Senthil Kumar Rajagopal <skrajago@codeaurora.org> | 2017-04-18 15:16:51 +0530 |
| commit | fd70b655d901e626403f132b65fc03d993f0a09b (patch) | |
| tree | 3d6ae1c18e38820d98678907ebd6ff24bca70982 /security/selinux/hooks.c | |
| parent | 7f0d77b390e15aa9ea4b517aec21a0e88e02f5a0 (diff) | |
msm: camera: isp: add bound check to handle array out of access
The pointer req_frm comes from userspace,
req_frm->stream_handle is passed as an argument to
the function msm_isp_get_stream_common_data,
stream_idx can overflow common_data->streams[] and
the code ends up copying an out of bound
kernel address into stream_info. Adding bound check to
handle the same.
CRs-fixed: 2008683
Change-Id: Ib4a059bfd573cdc4e18ce630b4091576ff8edc7e
Signed-off-by: Senthil Kumar Rajagopal <skrajago@codeaurora.org>
Diffstat (limited to 'security/selinux/hooks.c')
0 files changed, 0 insertions, 0 deletions