Check the number of bytes to copy against the size of the
user buffer before copy to user to avoid buffer overflow.
Change-Id: I95083227cfefaf1a81815296145b0c370127e061
Signed-off-by: Harsh Sahu <hsahu@codeaurora.org>
-/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
if (__sde_rot_evtlog_dump_calc_range()) {
len = sde_rot_evtlog_dump_entry(evtlog_buf,
SDE_ROT_EVTLOG_BUF_MAX);
+ if (len < 0 || len > count) {
+ pr_err("len is more than the user buffer size\n");
+ return 0;
+ }
+
if (copy_to_user(buff, evtlog_buf, len))
return -EFAULT;
*ppos += len;