diff options
| author | Ashish Garg <ashigarg@codeaurora.org> | 2017-09-14 13:13:16 +0530 |
|---|---|---|
| committer | Ashish Garg <ashigarg@codeaurora.org> | 2017-09-14 14:27:31 +0530 |
| commit | 93e91f73b211165a24708da0367429cbdffc33a1 (patch) | |
| tree | 708c6f03d910b390076e786d98f88d6eddb4e352 /tools/perf/scripts/python | |
| parent | 414269dd957a220c48ca82cb3364412f50d18c98 (diff) | |
msm: mdss: check the length of the external input buffer properly
dchdr->dlen is a short variable controlled by the user-provided data
(a string). If the value is negative, the condition does not pass
and loop continues, also increasing the value of "len". As a result
buffer overflow and overwrite occurs.
Change-Id: I5eacec446c9a8b5b82fc3bc6d1281303f336d4de
Signed-off-by: Ashish Garg <ashigarg@codeaurora.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions