platform: msm_shared: fix the bug of array index out of bounds.
Fix the buffer overflow issue in smd_write that the len_to_cmd
would exceed the size of rpm_cmd.
CRs-Fixed: 729344
Change-Id: I34ca840b424c834c7f66a2a3b7156deba9e940c1
diff --git a/platform/msm_shared/rpm-smd.c b/platform/msm_shared/rpm-smd.c
index 6144fba..d623542 100644
--- a/platform/msm_shared/rpm-smd.c
+++ b/platform/msm_shared/rpm-smd.c
@@ -114,7 +114,7 @@
case RPM_CMD_TYPE:
cmd.hdr.type = RPM_CMD_MAGIC;
cmd.hdr.len = CMD_MSG_LENGTH;//0x8;
- len_to_smd = 0x12;
+ len_to_smd = sizeof(rpm_cmd);
fill_kvp_object(&cmd.data, data, len);
ret = smd_write(&ch, (void *)&cmd, len_to_smd, SMD_APPS_RPM);