Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c543c42a authored by Hardik Arya's avatar Hardik Arya
Browse files

diag: Update msg mask's ranges properly 



There is a possibility of out-of-bound read if msg mask
ranges received from peripheral are more than max ssid per
range. Cap msg mask's ssid ranges to MAX_SSID_PER_RANGE if
ranges received from peripheral are greater than the same.

Change-Id: I886692ad223e16678bfaecbe381c62fdf3503cb5
Signed-off-by: default avatarHardik Arya <harya@codeaurora.org>
parent 7a6e9213

drivers/char/diag/diagfwd_cntl.c

+6 −1
Original line number Diff line number Diff line
@@ -619,7 +619,12 @@ static int update_msg_mask_tbl_entry(struct diag_msg_mask_t *mask, 
	}

	if (range->ssid_last >= mask->ssid_last) {

		temp_range = range->ssid_last - mask->ssid_first + 1;

		if (temp_range > MAX_SSID_PER_RANGE) {

			temp_range = MAX_SSID_PER_RANGE;

			mask->ssid_last = mask->ssid_first + temp_range - 1;

		} else

			mask->ssid_last = range->ssid_last;

		mask->ssid_last_tools = mask->ssid_last;

		mask->range = temp_range;

	}