From c176a066dfd36e31ebaf2796a12b2c523e7083dc Mon Sep 17 00:00:00 2001 From: Manoj Prabhu B Date: Fri, 14 Jun 2019 10:08:52 +0530 Subject: [PATCH] diag: dci: Correct out of bounds check in processing dci pkt rsp Correct the out of bounds check and prevent moving the temp pointer further than out of bounds check which is not necessary while processing dci pkt rsp. Change-Id: I01f8cd7454aff81b24c986eade35c79724976151 Signed-off-by: Manoj Prabhu B --- drivers/char/diag/diag_dci.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index aedeeef0911d..d18768b0e9da 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -1947,7 +1947,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) if (!buf) return -EIO; - if (len <= (sizeof(struct dci_pkt_req_t) + + if (len < (sizeof(struct dci_pkt_req_t) + sizeof(struct diag_pkt_header_t)) || len > DCI_REQ_BUF_SIZE) { pr_err("diag: dci: Invalid length %d len in %s", len, __func__); @@ -1960,7 +1960,6 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) req_len -= sizeof(struct dci_pkt_req_t); req_buf = temp; /* Start of the Request */ header = (struct diag_pkt_header_t *)temp; - temp += sizeof(struct diag_pkt_header_t); read_len += sizeof(struct diag_pkt_header_t); if (read_len >= DCI_REQ_BUF_SIZE) { pr_err("diag: dci: In %s, invalid read_len: %d\n", __func__,