diff options
| author | Zhang Shurong <[email protected]> | 2023-07-08 18:22:52 +0800 |
|---|---|---|
| committer | Hans Verkuil <[email protected]> | 2023-07-19 12:57:50 +0200 |
| commit | 5ae544d94abc8ff77b1b9bf8774def3fa5689b5b (patch) | |
| tree | 7600a999257e8528f01305c84a6e8f80053086e7 /tools/perf/scripts/python/flamegraph.py | |
| parent | 1f62bf4fb835aca6ca9aba977be9c50f7acf7be4 (diff) | |
media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach dw2102_i2c_transfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 950e252cb469
("[media] dw2102: limit messages to buffer size")
Signed-off-by: Zhang Shurong <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/flamegraph.py')
0 files changed, 0 insertions, 0 deletions