msm: camera: sync: Prevent OOB access of sync name
Issue: strlcpy calls strlen on src ptr. If src is not NULL terminated then OOB access will occur in below stack. strlen strlcpy cam_sync_init_row cam_sync_handle_create cam_sync_dev_ioctl Fix: Pad user-space supplied name with NULL. CRs-Fixed: 3010262 Change-Id: Ib5c2fbfe395025ec05e0bb2980f86111e95ff54c Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
This commit is contained in:

committed by
Gerrit - the friendly Code Review server

parent
110420ce29
commit
0d847c06fe
@@ -488,6 +488,7 @@ static int cam_sync_handle_create(struct cam_private_ioctl_arg *k_ioctl)
|
||||
u64_to_user_ptr(k_ioctl->ioctl_ptr),
|
||||
k_ioctl->size))
|
||||
return -EFAULT;
|
||||
sync_create.name[SYNC_DEBUG_NAME_LEN] = '\0';
|
||||
|
||||
result = cam_sync_create(&sync_create.sync_obj,
|
||||
sync_create.name);
|
||||
|
Reference in New Issue
Block a user