msm: ais: sensor: actuator: avoid accessing out of bound memory
Issue:
When total_steps is updated, after that, copy_from_user
fails with an error, then, i2c_reg_tbl is not allocated.
In this case, when calling msm_actuator_parse_i2c_params,
it lead to out-of-bound memory write.
Fix:
1) Assign total_steps to zero when error from copying.
2) Add NULL pointer check for i2c tbl.
3) Fixing the issue where the function can return
with an error code leaving "a_ctrl->i2c_reg_tbl"
and "a_ctrl->total_steps" out of sync.
Change-Id: Ib46deceb7bd8efff1cb606b894396e7016271dd3
Signed-off-by:
Rahul Sharma <sharah@codeaurora.org>
Loading
Please register or sign in to comment