Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0106549b authored by Kaushal Hooda's avatar Kaushal Hooda Committed by Surapusetty Naresh Babu
Browse files

rpmsg: slatecom: out of bound read from process_cmd



When dereferencing "rx_data" as type "glink_slatecom_msg" ,
we didn't check if "rx_data" has enough room to hold that type.
The "rx_size" is read from slate to master fifo and if received
rx_size is less then "glink_slatecom_msg" then it could lead to
heap out of bounds read.

If received rx_size is less then the expected glink_slatecom_msg
then return back as a bad message.

Change-Id: Idde757ee70c7c88c22e4f036e6da0280e3b385d0
Signed-off-by: default avatarKaushal Hooda <quic_khooda@quicinc.com>
(cherry picked from commit 7ddb61a6)
parent fad51170
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment