Qualcomm Adreno GPU MSM Driver Perfcounter Query Heap Overflow
Posted by deepcore on March 1, 2016 – 3:41 pm
The Adreno GPU driver for the MSM Linux kernel contains a heap overflow in the IOCTL_KGSL_PERFCOUNTER_QUERY ioctl command. The bug results from an incorrect conversion to a signed type when calculating the minimum count value for the query option. This results in a negative integer being used to calculate the size of a buffer, which can result in an integer overflow and a small sized allocation on 32-bit systems.
Post a reply
You must be logged in to post a comment.