Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02b3ab6c authored by Amir Samuelov's avatar Amir Samuelov Committed by Gerrit - the friendly Code Review server
Browse files

spcom: check size before calling copy_to_user()



Calling copy_to_user(to, from, size) with negative value
might cause heap overflow since size is unsigned parameter
and negative value is cast to big unsigned value.

CRs-Fixed: 1092683
Change-Id: I9b4a0710aa33942de2976f7ee158a8025dd6a20e
Signed-off-by: default avatarAmir Samuelov <amirs@codeaurora.org>
parent a3c6f163
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment