diff options
| author | Siqi Lin <siqilin@google.com> | 2016-11-02 16:51:08 -0700 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-06-07 13:18:23 -0600 |
| commit | 9e831345237335c96a086a1576d168073f0cf063 (patch) | |
| tree | e74361e8d481d80197086931bca02829d84ff794 /lib/mpi/mpiutil.c | |
| parent | c746791c713f04e55e4e6e42501a9b6cc6587249 (diff) | |
ALSA: info: Check for integer overflow in snd_info_entry_write()
snd_info_entry_write() resizes the buffer with an unsigned long
size argument that gets truncated because resize_info_buffer()
takes the size parameter as an unsigned int. On 64-bit kernels,
this causes the following copy_to_user() to write out-of-bounds
if (pos + count) can't be represented by an unsigned int.
Bug: 32510733
Change-Id: I9e8b55f93f2bd606b4a73b5a4525b71ee88c7c23
Signed-off-by: Siqi Lin <siqilin@google.com>
Diffstat (limited to 'lib/mpi/mpiutil.c')
0 files changed, 0 insertions, 0 deletions