diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-06-24 01:32:04 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-06-24 01:32:04 -0700 |
| commit | 9e83c541e2ed72b475f8ec2184c4559ae2d157de (patch) | |
| tree | 2af74da7ec92e788dd2491dba3cbf95ab84752b7 | |
| parent | b858364f0f438e88f1d3a49e4ea7f8a1d523d013 (diff) | |
| parent | fc3f5111eb7d24380d8d45ec2225dd6e9ab14a18 (diff) | |
Merge "diag: dci: Correct out of bounds check in processing dci pkt rsp" into kernel.lnx.4.14.r3-relLA.UM.7.9.r1-07500-sm6150.0
| -rw-r--r-- | drivers/char/diag/diag_dci.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index 7c72553b97c7..336dd8d6317b 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -1952,7 +1952,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) if (!buf) return -EIO; - if (len <= (sizeof(struct dci_pkt_req_t) + + if (len < (sizeof(struct dci_pkt_req_t) + sizeof(struct diag_pkt_header_t)) || len > DCI_REQ_BUF_SIZE) { pr_err("diag: dci: Invalid length %d len in %s", len, __func__); @@ -1965,7 +1965,6 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) req_len -= sizeof(struct dci_pkt_req_t); req_buf = temp; /* Start of the Request */ header = (struct diag_pkt_header_t *)temp; - temp += sizeof(struct diag_pkt_header_t); read_len += sizeof(struct diag_pkt_header_t); if (read_len >= DCI_REQ_BUF_SIZE) { pr_err("diag: dci: In %s, invalid read_len: %d\n", __func__, |