From 4fedfe5c4d9fc63e8c701e865850ab81259fa9a9 Mon Sep 17 00:00:00 2001 From: Deepak Kumar Singh Date: Tue, 5 Mar 2019 17:16:54 +0530 Subject: [PATCH] soc: qcom: qmi_encdec: Restrict string length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of bounds access when the NULL character is appended in decoding. CR-Fixed: 2359244 Change-Id: I4d789bc6017ff58458f77fe875ca4e175a4f1357 Signed-off-by: Chris Lew Signed-off-by: Deepak Kumar Singh --- lib/qmi_encdec.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/qmi_encdec.c b/lib/qmi_encdec.c index 72b506bececc..9d5c446830ed 100644 --- a/lib/qmi_encdec.c +++ b/lib/qmi_encdec.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2015, 2019 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -710,8 +710,8 @@ static int qmi_decode_string_elem(struct elem_info *ei_array, void *buf_dst, decoded_bytes += rc; } - if (string_len > temp_ei->elem_len) { - pr_err("%s: String len %d > Max Len %d\n", + if (string_len >= temp_ei->elem_len) { + pr_err("%s: String len %d >= Max Len %d\n", __func__, string_len, temp_ei->elem_len); return -ETOOSMALL; } else if (string_len > tlv_len) {