Skip to content
Commit e9e1f133 authored by Jack Pham's avatar Jack Pham
Browse files

usb: pd: avoid out-of-bounds access when reading PDOs



Most often a source will send fewer than the maximum number
of PDOs (7). Since the rx_msg buffer is now allocated up to
the size of the actual data, honor the rx_msg->data_len when
copying to pd->received_pdos rather than always 28 bytes.
This fixes out-of-bounds read access as reported by KASAN.

Change-Id: I5f98f7ccba027c1ab436ccf6fc822e2a319bafa1
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
parent e3950ebc
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment