Commit 02b3ab6c authored Nov 26, 2016 by Amir Samuelov Committed by Gerrit - the friendly Code Review server Dec 20, 2016

spcom: check size before calling copy_to_user()



Calling copy_to_user(to, from, size) with negative value
might cause heap overflow since size is unsigned parameter
and negative value is cast to big unsigned value.

CRs-Fixed: 1092683
Change-Id: I9b4a0710aa33942de2976f7ee158a8025dd6a20e
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>

parent a3c6f163

drivers/soc/qcom/spcom.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -2018,6 +2018,11 @@ static ssize_t spcom_device_read(struct file filp, char __user user_buff,
		return -ENOMEM;

		actual_size = spcom_handle_read(ch, buf, size);
		if ((actual_size <= 0) \|\| (actual_size > size)) {
		pr_err("invalid actual_size [%d].\n", actual_size);
		kfree(buf);
		return -EFAULT;
		}

		ret = copy_to_user(user_buff, buf, actual_size);