Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aaa4dd32 authored by Manoj Prabhu B's avatar Manoj Prabhu B Committed by Gerrit - the friendly Code Review server
Browse files

diag: Prevent out of bound write while sending dci pkt to remote 



Sanitize user input length for the maximum buffer size before
writing the dci packet to remote.

Change-Id: I1f813a969fcce589f9e5024864ef4a650f2cf64e
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent 0dc3f932

drivers/char/diag/diag_dci.c

+10 −1
Original line number Diff line number Diff line
@@ -1739,7 +1739,16 @@ static int diag_send_dci_pkt_remote(unsigned char *data, int len, int tag, 
	write_len += dci_header_size;

	*(int *)(buf + write_len) = tag;

	write_len += sizeof(int);

	if ((write_len + len) < DIAG_MDM_BUF_SIZE) {

		memcpy(buf + write_len, data, len);

	} else {

		pr_err("diag: skip writing invalid length packet, token: %d, pkt_len: %d\n",

			token, (write_len + len));

		spin_lock_irqsave(&driver->dci_mempool_lock, flags);

		diagmem_free(driver, buf, dci_ops_tbl[token].mempool);

		spin_unlock_irqrestore(&driver->dci_mempool_lock, flags);

		return -EAGAIN;

	}

	write_len += len;

	*(buf + write_len) = CONTROL_CHAR; /* End Terminator */

	write_len += sizeof(uint8_t);