-
- Downloads
Xi: Fix barrier device search
The function GetBarrierDevice() would search for the pointer device based on its device id and return the matching value, or supposedly NULL if no match was found. Unfortunately, as written, it would return the last element of the list if no matching device id was found which can lead to out of bounds memory access. Fix the search function to return NULL if not matching device is found, and adjust the callers to handle the case where the device cannot be found. CVE-2025-26598, ZDI-CAN-25740 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative Signed-off-by:Olivier Fourdan <ofourdan@redhat.com> Reviewed-by:
Peter Hutterer <peter.hutterer@who-t.net> Part-of: <!1828>
parent
0e4ed949
No related branches found
No related tags found
Loading
Please register or sign in to comment