Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase.
size = sizeof(p_info_32) + p_info_32.param_size;
This overflow issue may result heap overflow during copying the data:
memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32));
The validation check is added so that heap overflow can be avoided.
Change-Id: I11dcbe7ebb33e349dfd9f347f3ef25bc781075fc
Signed-off-by:
Raza Kamal <quic_razkam@quicinc.com>
Loading