Most often a source will send fewer than the maximum number of PDOs (7). Since the rx_msg buffer is now allocated up to the size of the actual data, honor the rx_msg->data_len when copying to pd->received_pdos rather than always 28 bytes. This fixes out-of-bounds read access as reported by KASAN. Change-Id: I5f98f7ccba027c1ab436ccf6fc822e2a319bafa1 Signed-off-by: Jack Pham <jackp@codeaurora.org> |
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
policy_engine.c | ||
qpnp-pdphy.c | ||
usbpd.h |