summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorŁukasz Stelmach <l.stelmach@samsung.com>2021-04-08 14:09:24 +0200
committerŁukasz Stelmach <l.stelmach@samsung.com>2021-04-09 11:11:53 +0200
commitef6082f2da28c879464f073b28eaf11a8105d174 (patch)
treec72ae336cb4bf051786b5d78072774ed0ea3c19d
parent192433f97aa83f1a4547db70e07d57c852b7ace6 (diff)
downloadlinux-rpi3-ef6082f2da28c879464f073b28eaf11a8105d174.tar.gz
linux-rpi3-ef6082f2da28c879464f073b28eaf11a8105d174.tar.bz2
linux-rpi3-ef6082f2da28c879464f073b28eaf11a8105d174.zip
logger: Fix incorrect buffer access when writing datasubmit/tizen/20210409.113436accepted/tizen/unified/20210412.012038
Fix crash caused by accessing memory beyond log->buffer Change-Id: I528b62e34e9fb5f92f62f6b218718e15cd5f7d31 Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
-rw-r--r--drivers/staging/android/logger.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
index 8988e4b61980..fb6afb3f8dc6 100644
--- a/drivers/staging/android/logger.c
+++ b/drivers/staging/android/logger.c
@@ -531,7 +531,7 @@ static void write_log_data(struct logger_log *log,
/* message */
len = min(chunk_len, log->size - w_off);
- memcpy(log->buffer + w_off, writer->buffer, chunk_len);
+ memcpy(log->buffer + w_off, writer->buffer, len);
memcpy(log->buffer, writer->buffer + len, chunk_len - len);
log->w_off = logger_offset(log, w_off + chunk_len);
}