Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 70726f13 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: adsprpc: Add checks to avoid buffer overflow"

parents 35592996 a13f71e8

drivers/char/adsprpc.c

+4 −3
Original line number Diff line number Diff line
@@ -2230,7 +2230,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
	int outbufs = REMOTE_SCALARS_OUTBUFS(sc);

	int handles, bufs = inbufs + outbufs;

	uintptr_t args = 0;

	size_t rlen = 0, copylen = 0, metalen = 0, lrpralen = 0;

	size_t rlen = 0, copylen = 0, metalen = 0, lrpralen = 0, templen = 0;

	size_t totallen = 0; //header and non ion copy buf len

	int i, oix;

	int err = 0, j = 0;
@@ -2328,12 +2328,13 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
			copylen = ALIGN(copylen, BALIGN);

		mstart = ctx->overps[oix]->mstart;

		mend = ctx->overps[oix]->mend;

		VERIFY(err, (mend - mstart) <= LONG_MAX);

		templen = mend - mstart;

		VERIFY(err, ((templen <= LONG_MAX) && (copylen <= (LONG_MAX - templen))));

		if (err) {

			err = -EFAULT;

			goto bail;

		}

		copylen += mend - mstart;

		copylen += templen;

	}

	totallen = ALIGN(totallen, BALIGN) + copylen;