From 998b7faca0c391a7279f0343bf4deb2b0419e09f Mon Sep 17 00:00:00 2001 From: Manoj Prabhu B Date: Tue, 20 Sep 2016 10:06:09 +0530 Subject: [PATCH] diag: Fix possible buffer corruption by proper typecasting This patch removes the possibilty of header length and read length having negative values and thereby possible buffer corruption. CRs-Fixed: 1002389 Change-Id: Id74650d5c4aaf9f84a56372f60ff5a40374e8f7b Signed-off-by: Manoj Prabhu B --- drivers/char/diag/diagfwd_cntl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/char/diag/diagfwd_cntl.c b/drivers/char/diag/diagfwd_cntl.c index 594d3b1bf3b5..9f43cb5427f0 100644 --- a/drivers/char/diag/diagfwd_cntl.c +++ b/drivers/char/diag/diagfwd_cntl.c @@ -651,8 +651,8 @@ static void process_build_mask_report(uint8_t *buf, uint32_t len, void diag_cntl_process_read_data(struct diagfwd_info *p_info, void *buf, int len) { - int read_len = 0; - int header_len = sizeof(struct diag_ctrl_pkt_header_t); + uint32_t read_len = 0; + uint32_t header_len = sizeof(struct diag_ctrl_pkt_header_t); uint8_t *ptr = buf; struct diag_ctrl_pkt_header_t *ctrl_pkt = NULL;