msm: camera: sync: Prevent OOB access of sync name
Issue: strlcpy calls strlen on src ptr. If src is not NULL terminated then OOB access will occur in below stack. strlen strlcpy cam_sync_init_row cam_sync_handle_create cam_sync_dev_ioctl Fix: Pad user-space supplied name with NULL. CRs-Fixed: 3010262 Change-Id: Ib5c2fbfe395025ec05e0bb2980f86111e95ff54c Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
Este cometimento está contido em:

cometido por
Gerrit - the friendly Code Review server

ascendente
110420ce29
cometimento
0d847c06fe
@@ -488,6 +488,7 @@ static int cam_sync_handle_create(struct cam_private_ioctl_arg *k_ioctl)
|
||||
u64_to_user_ptr(k_ioctl->ioctl_ptr),
|
||||
k_ioctl->size))
|
||||
return -EFAULT;
|
||||
sync_create.name[SYNC_DEBUG_NAME_LEN] = '\0';
|
||||
|
||||
result = cam_sync_create(&sync_create.sync_obj,
|
||||
sync_create.name);
|
||||
|
Criar uma nova questão referindo esta
Bloquear um utilizador