evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "qseecom: correct range check in __qseecom_update_qteec_req_buf"

Browse source
This commit is contained in:
Linux Build Service Account 2019-09-17 04:46:22 -07:00 • committed by Gerrit - the friendly Code Review server
commit 2eacd40256
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/misc/qseecom.c
View file

@ -6422,9 +6422,11 @@ static int __qseecom_update_qteec_req_buf(struct qseecom_qteec_modfd_req *req,
pr_err("Ion client can't retrieve the handle\n");
return -ENOMEM;
}
if ((req->req_len < sizeof(uint32_t)) ||
if ((req->req_len <
sizeof(struct qseecom_param_memref)) ||
(req->ifd_data[i].cmd_buf_offset >
req->req_len - sizeof(uint32_t))) {
req->req_len -
sizeof(struct qseecom_param_memref))) {
pr_err("Invalid offset/req len 0x%x/0x%x\n",
req->req_len,
req->ifd_data[i].cmd_buf_offset);