msm: ais: Fix kernel overwrite GET_BUF_BY_IDX ioctl
Assign address of buf_info into ioctl_ptr. Previously we were copying first 8 bytes of buf_info (content) into ioctl_ptr. Which is dereferenced and written later causing kernel overwrite vulnerability. CRs-fixed: 2013631 Change-Id: Ia27dafe003c2c4d7a59dc2976bee2cfc15978403 Signed-off-by:Terence Ho <terenceh@codeaurora.org> Signed-off-by:
Andy Sun <bins@codeaurora.org>
Loading
Please register or sign in to comment