From 82caeda1398689e495f03c00e4fc1547bb810ae8 Mon Sep 17 00:00:00 2001 From: Manoj Prabhu B Date: Wed, 24 Apr 2019 21:42:10 +0530 Subject: [PATCH] diag: Prevent out of bound access while getting build mask Add check for minimum length before typecasting to build mask structure to prevent out of bound access. CRs-Fixed: 2431005 Change-Id: I97b439ead62c8a67869c9209442ef771308f2d3f Signed-off-by: Manoj Prabhu B --- drivers/char/diag/diag_masks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c index 438f33d8cadb..04d827de8570 100644 --- a/drivers/char/diag/diag_masks.c +++ b/drivers/char/diag/diag_masks.c @@ -643,7 +643,8 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len, struct diag_build_mask_req_t *req = NULL; struct diag_msg_build_mask_t rsp; - if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) { + if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || + src_len < sizeof(struct diag_build_mask_req_t)) { pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d\n", __func__, src_buf, src_len, dest_buf, dest_len); return -EINVAL;