evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

diag: Add conditional check for len in dci_process_ctrl_status()

Browse source 
Add correct conditional check for len in dci_process_ctrl_status() to
prevent buffer overflow.

Change-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
This commit is contained in:
Sreelakshmi Gownipalli 2018-01-29 13:17:13 -08:00 • committed by Gerrit - the friendly Code Review server
parent 07ec991ea1
commit 94cda67dae
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/char/diag/diag_dci.c
View file

@ -863,7 +863,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token)
read_len += sizeof(struct diag_ctrl_dci_status); read_len += sizeof(struct diag_ctrl_dci_status);
for (i = 0; i < header->count; i++) { for (i = 0; i < header->count; i++) {
if (read_len > len) { if (read_len > (len - 2)) {
pr_err("diag: In %s, Invalid length len: %d\n", pr_err("diag: In %s, Invalid length len: %d\n",
__func__, len); __func__, len);
return; return;