misc/uacce: fixup out-of-bounds array write
driver inclusion category: Bugfix bugzilla: NA CVE: NA Size in uacce_alloc_dma_buffers api is from mmap size. If size is too big, which can cause size + max_size - 1 overflow. Then ss_num is negative, uacce_sort_dma_buffers api may cause out-of-bounds arraywrite. Signed-off-by:Yu'an Wang <wangyuan46@huawei.com> Signed-off-by:
Kai Ye <yekai13@huawei.com> Reviewed-by:
Zhou Wang <wangzhou1@hisilicon.com> Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com>
Loading
Please sign in to comment