diff options
| author | Senthil Kumar Rajagopal <skrajago@codeaurora.org> | 2017-02-15 15:08:09 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-28 01:24:14 -0800 |
| commit | 9fa25bf455f815a748bb518d300e84e1560bdf23 (patch) | |
| tree | 17e05d2e4ee7ef6ee939c3cba306a52932c1c463 /tools/perf/scripts/python | |
| parent | 10a55a587418b3c37a57b4beae8337432b6ff3c0 (diff) | |
msm: isp: fix for potentitial array out of bound access
There is no bound check on dual_hw_ms_cmd->num_src,
which is coming from userspace
num_src is used as the limit for the for loop.
The max num_src can hold is 255 (type uint8_t).
This implies that i can go upto to 254.
However dual_hw_ms_cmd->input_src can only hold 5 bytes.
So, we may acces out of bound array.
CRs-Fixed: 2006169
Change-Id: If5927e06e70cce4afb0ae9f2cdfec80f76f83771
Signed-off-by: Senthil Kumar Rajagopal <skrajago@codeaurora.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions