Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ee5558e authored by Udaya Bhaskara Reddy Mallavarapu's avatar Udaya Bhaskara Reddy Mallavarapu Committed by Gerrit - the friendly Code Review server
Browse files

drivers: media: broadcast: Fix security vulnerability issue 



Information leak issue is reported in mpq_sdmx_log_level_write
function. Added check to validate count is not zero and initialize
the string.

Change-Id: Ieb2ed88c2d7d778c56be2ec3b9875270a9c74dce
Signed-off-by: default avatarUdaya Bhaskara Reddy Mallavarapu <udaym@codeaurora.org>
parent 8f09bb72

drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c

+6 −2
Original line number Diff line number Diff line
@@ -354,13 +354,17 @@ static ssize_t mpq_sdmx_log_level_write(struct file *fp, 
	int level;

	struct mpq_demux *mpq_demux = fp->private_data;



	if (count >= 16)

	if (count == 0 || count >= 16)

		return -EINVAL;



	ret_count = simple_write_to_buffer(user_str, 16, position, user_buffer,

	memset(user_str, '\0', sizeof(user_str));



	ret_count = simple_write_to_buffer(user_str, 15, position, user_buffer,

		count);

	if (ret_count < 0)

		return ret_count;

	else if (ret_count == 0)

		return -EINVAL;



	ret = kstrtoint(user_str, 0, &level);

	if (ret)