Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ef66921 authored by Jeya R's avatar Jeya R
Browse files

msm: adsprpc: Handle out-of-bounds read in debugfs 



Removed fixing the Title size which may not terminate
the NULL character end of Title. And, this would fix the
possible out-of-bounds read when reading debug-fs.

Change-Id: Ib3ff2b0106a25232c7a766baaaaca5bd9d306533
Acked-by: default avatarKrishnaiah Tadakamalla <ktadakam@qti.qualcomm.com>
Signed-off-by: default avatarJeya R <jeyr@codeaurora.org>
parent a170d4a1

drivers/char/adsprpc.c

+2 −3
Original line number Diff line number Diff line
@@ -64,7 +64,6 @@ 


#define FASTRPC_ENOSUCH 39

#define DEBUGFS_SIZE 3072

#define UL_SIZE 25

#define PID_SIZE 10



#define AUDIO_PDR_ADSP_DTSI_PROPERTY_NAME        "qcom,fastrpc-adsp-audio-pdr"
@@ -5235,8 +5234,8 @@ static ssize_t fastrpc_debugfs_read(struct file *filp, char __user *buffer, 
	unsigned int len = 0;

	int i, j, sess_used = 0, ret = 0;

	char *fileinfo = NULL;

	char single_line[UL_SIZE] = "----------------";

	char title[UL_SIZE] = "=========================";

	char single_line[] = "----------------";

	char title[] = "=========================";



	fileinfo = kzalloc(DEBUGFS_SIZE, GFP_KERNEL);

	if (!fileinfo) {