| commit | 1c9df0a8f6025b79df1267e42c7319a660732b19 | [log] [tgz] |
|---|---|---|
| author | Peter Collingbourne <pcc@google.com> | Tue Oct 20 00:15:44 2020 -0700 |
| committer | Amit Pundir <amit.pundir@linaro.org> | Sun Nov 01 23:31:09 2020 +0530 |
| tree | 29731ba8bde990d9d730583fc68adea226db3b57 | |
| parent | 72db22767387a8995e997b4d61994f3ec4e93d15 [diff] |
Fix an out-of-bounds read in assoc_next. cherry-picked from upstream device/linaro/dragonboard project. Found using HWASan. Also sent upstream: https://github.com/andersson/pd-mapper/pull/5 Bug: 171327997 Change-Id: I69d07d0228719abbffb38aa709de39c1d8190158 Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
diff --git a/qcom/pd-mapper/assoc.c b/qcom/pd-mapper/assoc.c index 692c882..460f0d0 100644 --- a/qcom/pd-mapper/assoc.c +++ b/qcom/pd-mapper/assoc.c
@@ -128,7 +128,7 @@ { unsigned long it = *iter; - while (!assoc->keys[it] && it < assoc->size) + while (it < assoc->size && !assoc->keys[it]) it++; if (it == assoc->size)