From 42e0f618e96a64e892a1c50e3d1b5420ecb4b997 Mon Sep 17 00:00:00 2001 From: Rajesh Bondugula Date: Tue, 15 Nov 2016 13:52:49 -0800 Subject: msm: camera: sensor: Validate eeprom_name string length Validate eeprom_name string length before copying into the userspace buffer. If more data than required is copied, userspace has the access to some of kernel data which is not intended. This change will fix the issue. CRs-Fixed: 1090007 Signed-off-by: Rajesh Bondugula Change-Id: Id40a287e0b1a93cc15d9b02c757fe9f347e285f2 --- include/uapi/media/msm_cam_sensor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/uapi') diff --git a/include/uapi/media/msm_cam_sensor.h b/include/uapi/media/msm_cam_sensor.h index 172545d34b7d..c6144cd8f355 100644 --- a/include/uapi/media/msm_cam_sensor.h +++ b/include/uapi/media/msm_cam_sensor.h @@ -305,7 +305,7 @@ struct msm_eeprom_cfg_data { enum eeprom_cfg_type_t cfgtype; uint8_t is_supported; union { - char eeprom_name[MAX_SENSOR_NAME]; + char eeprom_name[MAX_EEPROM_NAME]; struct eeprom_get_t get_data; struct eeprom_read_t read_data; struct eeprom_write_t write_data; -- cgit v1.2.3