-
- Downloads
spcom: check size before calling copy_to_user()
CVE-2016-5854
Calling copy_to_user(to, from, size) with negative value
might cause heap overflow since size is unsigned parameter
and negative value is cast to big unsigned value.
CRs-Fixed: 1092683
Change-Id: I9b4a0710aa33942de2976f7ee158a8025dd6a20e
Signed-off-by:
Amir Samuelov <amirs@codeaurora.org>
Loading
Please register or sign in to comment