diff options
| author | Haibin Liu <haibinl@qti.qualcomm.com> | 2017-10-24 20:32:48 +0800 |
|---|---|---|
| committer | Oleg Matcovschi <omatcovschi@google.com> | 2018-03-15 15:24:47 -0700 |
| commit | c66dbfd52723e5e6ab63cea7b7ad54d18e51b8fe (patch) | |
| tree | 1b5ed8dabf3e43e4bd8baa6d5e5d0d393e352e1d /net/lapb/lapb_timer.c | |
| parent | 9b0a42acd5033ae3a4b1b5d62f2057c6e033f7d3 (diff) | |
msm: sensor: actuator: avoid accessing out of bound memory
Issue:
When total_steps is updated, after that, copy_from_user
fails with an error, then, i2c_reg_tbl is not allocated.
In this case, when calling msm_actuator_parse_i2c_params,
it lead to out-of-bound memory write.
Fix:
1) Assign total_steps to zero when error from copying.
2) Add NULL pointer check for i2c tbl.
CRs-Fixed: 2111672
Bug: 65122765
Change-Id: Ib9dcb182356e2df8078c131edfd0791fa95a35e0
Signed-off-by: Haibin Liu <haibinl@codeaurora.org>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions