Fixed out of the bounds memcpy in maru evdi 45/220945/1
authorAndrey Kazmin <a.kazmin@partner.samsung.com>
Mon, 16 Dec 2019 07:25:53 +0000 (10:25 +0300)
committerDongkyun Son <dongkyun.s@samsung.com>
Thu, 26 Dec 2019 03:51:35 +0000 (12:51 +0900)
Change-Id: I87565fde5a245f813dde58164220e52647647a89
Signed-off-by: Andrey Kazmin <a.kazmin@partner.samsung.com>
drivers/maru/maru_virtio_evdi.c

index 74e8d36..d30ea81 100644 (file)
@@ -210,7 +210,7 @@ static void send_guest_connected_msg(bool connected)
 
        memset(_msg, 0, sizeof(vevdi->send_msginfo));
 
-       memcpy(_msg->buf, GUEST_CONNECTION_CATEGORY, 7);
+       memcpy(_msg->buf, GUEST_CONNECTION_CATEGORY, sizeof(GUEST_CONNECTION_CATEGORY));
        memcpy(_msg->buf + ID_SIZE + 3, &connect, 1);
        _msg->route = route_control_server;
        _msg->use = ID_SIZE + HEADER_SIZE;