diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-08-21 20:01:12 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-08-21 20:01:11 -0700 |
| commit | 5f76ac9d86faef7f59267d6228961af434c1edfc (patch) | |
| tree | ef897248d9e7143562b18907b5973f868b79cfaa | |
| parent | fc59d81f3e365c56098f454e798a2b508a8a098d (diff) | |
| parent | 73b20757e5640e348f7881d2e38ccddcb6ab0a86 (diff) | |
Merge "msm: ADSPRPC: validate user buffers after copying from user"
| -rw-r--r-- | drivers/char/adsprpc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index a8e23598ea58..aba9010c5aa2 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -2700,6 +2700,10 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int ioctl_num, VERIFY(err, 0 == copy_from_user(&p.init, param, size)); if (err) goto bail; + VERIFY(err, p.init.init.filelen >= 0 && + p.init.init.memlen >= 0); + if (err) + goto bail; VERIFY(err, 0 == fastrpc_init_process(fl, &p.init)); if (err) goto bail; |