Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 3d5955a2 authored by Raza Kamal's avatar Raza Kamal
Browse files

Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase.


size = sizeof(p_info_32) + p_info_32.param_size;
This overflow issue may result heap overflow during copying the data:
memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32));

The validation check is added so that heap overflow can be avoided.

Change-Id: I11dcbe7ebb33e349dfd9f347f3ef25bc781075fc
Signed-off-by: default avatarRaza Kamal <quic_razkam@quicinc.com>
parent 5492426a
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment