Merge "diag: Prevent possible integer overflow while processing cntl pkt" (a01aa5bb) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/char/diag/diagfwd_cntl.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -989,7 +989,8 @@ void diag_cntl_process_read_data(struct diagfwd_info p_info, void buf,

		while (read_len + header_len < len) {
		ctrl_pkt = (struct diag_ctrl_pkt_header_t *)ptr;
		if ((read_len + header_len + ctrl_pkt->len) > len)
		if (((size_t)read_len + (size_t)ctrl_pkt->len +
		header_len) > len)
		return;
		switch (ctrl_pkt->pkt_id) {
		case DIAG_CTRL_MSG_REG: