-
- Downloads
msm: camera: isp: Handle array out of bounds
The pointer qbuf_buf comes from userspace. qbuf_buf->num_planes is used with no bound check, which if set to a large value, it will overflow buf_info->mapped_info and qbuf_buf->planes Bug: 38196031 CRs-Fixed: 2003798 Change-Id: I332e0424e57bb14b481a740604a09350e6f029a8 Signed-off-by:Senthil Kumar Rajagopal <skrajago@codeaurora.org> Signed-off-by:
VijayaKumar T M <vtmuni@codeaurora.org> Signed-off-by:
Satyanarayana Dash <sadash@codeaurora.org>
Loading
Please register or sign in to comment