Commit 1dba4525 authored Apr 04, 2018 by Rashi Bindra

msm: mdss: Fix for wrong length in copy_to_user



The caller could have a small buf passed (less then < blen).
Since, the length of count and blen is not checked, it can
write beyond the end of buf.

Change-Id: I569528ace02c7b7cd3f73a3bdb176e56cc5759f4
Signed-off-by: Rashi Bindra <rbindra@codeaurora.org>

parent 20f19243

drivers/video/fbdev/msm/mdss_dsi.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -743,7 +743,7 @@ static ssize_t mdss_dsi_cmd_state_read(struct file file, char __user buf,
		if (blen < 0)
		return 0;

		if (copy_to_user(buf, buffer, blen))
		if (copy_to_user(buf, buffer, min(count, (size_t)blen+1)))
		return -EFAULT;

		*ppos += blen;