Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6d9cc5ec authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "diag: Validate msg source length to prevent out of bound access"

parents bceb6871 f90d6df7

drivers/char/diag/diag_masks.c

+2 −1
Original line number Diff line number Diff line
@@ -896,6 +896,7 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len, 
		goto end;

	if (mask_size + write_len > dest_len)

		mask_size = dest_len - write_len;

	if (mask_size && src_len >= header_len + mask_size)

		memcpy(dest_buf + write_len, src_buf + header_len, mask_size);

	write_len += mask_size;

	for (i = 0; i < NUM_MD_SESSIONS; i++) {