6b58859e7c
commit 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 upstream.
The QMI TLV value for strings in a lot of qmi element info structures
account for null terminated strings with MAX_LEN + 1. If a string is
actually MAX_LEN + 1 length, this will cause an out of bounds access
when the NULL character is appended in decoding.
Fixes:
|
||
---|---|---|
.. | ||
actions | ||
amlogic | ||
atmel | ||
bcm | ||
dove | ||
fsl | ||
gemini | ||
imx | ||
lantiq | ||
mediatek | ||
qcom | ||
renesas | ||
rockchip | ||
samsung | ||
sunxi | ||
tegra | ||
ti | ||
ux500 | ||
versatile | ||
xilinx | ||
zte | ||
Kconfig | ||
Makefile |