Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 16f99f5f authored by Hardik Arya's avatar Hardik Arya
Browse files

diag: Prevent out-of-bound access while processing mask commands 



Mask commands are being processed without proper check of buffer
length, which can lead to out of bound access. The patch adds
proper check for buffer length.

Change-Id: I6eb7ad01fb86f0cd0fb32390cfedd518428a64ba
Signed-off-by: default avatarHardik Arya <harya@codeaurora.org>
parent 81d52ee5

drivers/char/diag/diag_masks.c

+4 −0
Original line number Diff line number Diff line
@@ -2299,6 +2299,8 @@ int diag_process_apps_masks(unsigned char *buf, int len, int pid) 
		return -EINVAL;



	if (*buf == DIAG_CMD_LOG_CONFIG) {

		if (len < (2 * sizeof(int)))

			return -EINVAL;

		sub_cmd = *(int *)(buf + sizeof(int));

		switch (sub_cmd) {

		case DIAG_CMD_OP_LOG_DISABLE:
@@ -2316,6 +2318,8 @@ int diag_process_apps_masks(unsigned char *buf, int len, int pid) 
			break;

		}

	} else if (*buf == DIAG_CMD_MSG_CONFIG) {

		if (len < (2 * sizeof(uint8_t)))

			return -EINVAL;

		sub_cmd = *(uint8_t *)(buf + sizeof(uint8_t));

		switch (sub_cmd) {

		case DIAG_CMD_OP_GET_SSID_RANGE: