msm: ais: Fix kernel overwrite GET_BUF_BY_IDX ioctl
Assign address of buf_info into ioctl_ptr.
Previously we were copying first 8 bytes of buf_info (content)
into ioctl_ptr. Which is dereferenced and written later causing
kernel overwrite vulnerability.
CRs-fixed: 2013631
Change-Id: Ia27dafe003c2c4d7a59dc2976bee2cfc15978403
Signed-off-by:
Terence Ho <terenceh@codeaurora.org>
Loading
Please register or sign in to comment