Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17976c61 authored by Manoj Prabhu B's avatar Manoj Prabhu B Committed by Gerrit - the friendly Code Review server
Browse files

diag: dci: Correct out of bounds check in processing dci pkt rsp 



Correct the out of bounds check and prevent moving the temp pointer
further than out of bounds check which is not necessary while
processing dci pkt rsp.

Change-Id: I01f8cd7454aff81b24c986eade35c79724976151
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent 1fbb233d

drivers/char/diag/diag_dci.c

+1 −2
Original line number Diff line number Diff line
@@ -1957,7 +1957,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	if (!buf)

		return -EIO;



	if (len <= (sizeof(struct dci_pkt_req_t) +

	if (len < (sizeof(struct dci_pkt_req_t) +

		sizeof(struct diag_pkt_header_t)) ||

		len > DCI_REQ_BUF_SIZE) {

		pr_err("diag: dci: Invalid length %d len in %s\n",
@@ -1971,7 +1971,6 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	req_len -= sizeof(struct dci_pkt_req_t);

	req_buf = temp; /* Start of the Request */

	header = (struct diag_pkt_header_t *)temp;

	temp += sizeof(struct diag_pkt_header_t);

	read_len += sizeof(struct diag_pkt_header_t);

	if (read_len >= DCI_REQ_BUF_SIZE) {

		pr_err("diag: dci: In %s, invalid read_len: %d\n", __func__,