Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4195cd35 authored by Yuanyuan Liu's avatar Yuanyuan Liu Committed by Gerrit - the friendly Code Review server
Browse files

icnss: NULL terminate the fw build timestamp string 



If fw build timestamp passed by QMI is a non-NULL terminated string,
it might result in a out-of-bounds read in icnss_get_soc_info. Hence,
manually NULL terminate the string.

Change-Id: I252196cd12784d841b29303c42591efc59da64f1
CRs-Fixed: 2322317
Signed-off-by: default avatarYuanyuan Liu <yuanliu@codeaurora.org>
parent 64950996

drivers/soc/qcom/icnss.c

+4 −0
Original line number Diff line number Diff line
@@ -3185,6 +3185,8 @@ EXPORT_SYMBOL(icnss_disable_irq); 


int icnss_get_soc_info(struct device *dev, struct icnss_soc_info *info)

{

	char *fw_build_timestamp = NULL;



	if (!penv || !dev) {

		icnss_pr_err("Platform driver not initialized\n");

		return -EINVAL;
@@ -3197,6 +3199,8 @@ int icnss_get_soc_info(struct device *dev, struct icnss_soc_info *info) 
	info->board_id = penv->board_info.board_id;

	info->soc_id = penv->soc_info.soc_id;

	info->fw_version = penv->fw_version_info.fw_version;

	fw_build_timestamp = penv->fw_version_info.fw_build_timestamp;

	fw_build_timestamp[QMI_WLFW_MAX_TIMESTAMP_LEN_V01] = '\0';

	strlcpy(info->fw_build_timestamp,

		penv->fw_version_info.fw_build_timestamp,

		QMI_WLFW_MAX_TIMESTAMP_LEN_V01 + 1);