| commit | 6ba119257516c87a577993487c0b5aaa1ab0c0a1 | [log] [tgz] |
|---|---|---|
| author | Jerry Zhang <zhangjerry@google.com> | Mon Sep 25 18:14:51 2017 -0700 |
| committer | Jerry Zhang <zhangjerry@google.com> | Wed Sep 27 11:22:00 2017 -0700 |
| tree | 9f463950d4975cd009c2d0f5792c8a9b74bf72e3 | |
| parent | 71ff0801fe951c7f8780243a48ed254c540f8ed1 [diff] |
ANDROID: usb: gadget: f_mtp: Return error if count is negative If the user passes in a negative file size in a int64, this will compare to be smaller than buffer length, and it will get truncated to form a read length that is larger than the buffer length. To fix, return -EINVAL if the count argument is negative, so the loop will never happen. Bug: 37429972 Test: Test with PoC Change-Id: I5d52e38e6fbe2c17eb8c493f9eb81df6cfd780a4 Signed-off-by: Jerry Zhang <zhangjerry@google.com>