evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ais: Fix out-of-bounds read in string class name

Browse source 
jpeg driver is calling class_create with stack variable, which
can be overwritten by other stack variables.

Change-Id: I92ccd4629cef8a06b7715b8483cf53a9607bd22f
Signed-off-by: Deepak Shankar <dees@codeaurora.org>
Signed-off-by: Rahul Sharma <rahsha@codeaurora.org>
This commit is contained in:
Deepak Shankar 2018-08-16 14:59:17 +05:30 • committed by Gerrit - the friendly Code Review server
parent 7454980b83
commit 6ae64f78da
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/media/platform/msm/ais/jpeg_10/msm_jpeg_dev.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. /* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -32,6 +32,8 @@
#define MSM_JPEG_NAME "jpeg" #define MSM_JPEG_NAME "jpeg"
#define DEV_NAME_LEN 10 #define DEV_NAME_LEN 10
static char devname[DEV_NAME_LEN];
static int msm_jpeg_open(struct inode *inode, struct file *filp) static int msm_jpeg_open(struct inode *inode, struct file *filp)
{ {
int rc = 0; int rc = 0;
@ -185,7 +187,6 @@ static int msm_jpeg_init_dev(struct platform_device *pdev)
struct msm_jpeg_device *msm_jpeg_device_p; struct msm_jpeg_device *msm_jpeg_device_p;
const struct of_device_id *device_id; const struct of_device_id *device_id;
const struct msm_jpeg_priv_data *priv_data; const struct msm_jpeg_priv_data *priv_data;
char devname[DEV_NAME_LEN];
msm_jpeg_device_p = kzalloc(sizeof(struct msm_jpeg_device), GFP_ATOMIC); msm_jpeg_device_p = kzalloc(sizeof(struct msm_jpeg_device), GFP_ATOMIC);
if (!msm_jpeg_device_p) { if (!msm_jpeg_device_p) {