evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

diag: dci: Correct out of bounds check in processing dci pkt rsp

Browse source 
Correct the out of bounds check and prevent moving the temp pointer
further than out of bounds check which is not necessary while
processing dci pkt rsp.

Change-Id: I01f8cd7454aff81b24c986eade35c79724976151
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
This commit is contained in:
Manoj Prabhu B 2019-06-14 10:08:52 +05:30 • committed by Gerrit - the friendly Code Review server
parent cc47c2c325
commit c176a066df
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/char/diag/diag_dci.c
View file

@ -1947,7 +1947,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
if (!buf) if (!buf)
return -EIO; return -EIO;
if (len <= (sizeof(struct dci_pkt_req_t) + if (len < (sizeof(struct dci_pkt_req_t) +
sizeof(struct diag_pkt_header_t)) || sizeof(struct diag_pkt_header_t)) ||
len > DCI_REQ_BUF_SIZE) { len > DCI_REQ_BUF_SIZE) {
pr_err("diag: dci: Invalid length %d len in %s", len, __func__); pr_err("diag: dci: Invalid length %d len in %s", len, __func__);
@ -1960,7 +1960,6 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
req_len -= sizeof(struct dci_pkt_req_t); req_len -= sizeof(struct dci_pkt_req_t);
req_buf = temp; /* Start of the Request */ req_buf = temp; /* Start of the Request */
header = (struct diag_pkt_header_t *)temp; header = (struct diag_pkt_header_t *)temp;
temp += sizeof(struct diag_pkt_header_t);
read_len += sizeof(struct diag_pkt_header_t); read_len += sizeof(struct diag_pkt_header_t);
if (read_len >= DCI_REQ_BUF_SIZE) { if (read_len >= DCI_REQ_BUF_SIZE) {
pr_err("diag: dci: In %s, invalid read_len: %d\n", __func__, pr_err("diag: dci: In %s, invalid read_len: %d\n", __func__,