Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2025-10-01 16:08:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

Add patches for many Linux CVEs, and overhaul script paths

Browse source
This commit is contained in:
Tad 2017-10-29 01:48:53 -04:00
parent 8c8dc284c9
commit 75099b9404
801 changed files with 123220 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

35
Patches/Linux_CVEs/CVE-2014-9887/0.patch Normal file
View file

@ -0,0 +1,35 @@
From b1bc773cf61265e0e3871b2e52bd6b3270ffc6c3 Mon Sep 17 00:00:00 2001
From: Zhen Kong <zkong@codeaurora.org>
Date: Thu, 27 Mar 2014 12:44:15 -0700
Subject: qseecom: Validate pointer offset in qseecom_send_modfd_cmd
Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
make sure cmd buffer address to be within shared bufffer.
Change-Id: I431511a92ab2cccbc2daebc0cf76cc3872689a97
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
---
drivers/misc/qseecom.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c
index 5d2b64c..bce4994 100644
--- a/drivers/misc/qseecom.c
+++ b/drivers/misc/qseecom.c
@@ -1635,6 +1635,13 @@ static int qseecom_send_modfd_cmd(struct qseecom_dev_handle *data,
pr_err("response buffer address not within shared bufffer\n");
return -EINVAL;
}
+
+ if (req.cmd_req_len == 0 || req.cmd_req_len > data->client.sb_length ||
+ req.resp_len > data->client.sb_length) {
+ pr_err("cmd or response buffer length not valid\n");
+ return -EINVAL;
+ }
+
send_cmd_req.cmd_req_buf = req.cmd_req_buf;
send_cmd_req.cmd_req_len = req.cmd_req_len;
send_cmd_req.resp_buf = req.resp_buf;
--
cgit v1.1