Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca1c9dc6 authored by Chris Lew's avatar Chris Lew
Browse files

net: neuron: channel: Check buffer boundaries 



Sanitize the ring buffer length read from the other side to ensure
the bounds match the memory that is mapped.

Change-Id: Ifdac3e0dee11374e61ede3a2cfb82e1957c6a2b2
Signed-off-by: default avatarChris Lew <clew@codeaurora.org>
parent b482a807

net/neuron/channel/ch_haven_send.c

+2 −0
Original line number Diff line number Diff line
@@ -180,6 +180,8 @@ static int read_config(struct neuron_mq_data_priv *priv) 
	msgq->message_alignment = hdr->message_alignment;

	/* Get ring_buffer_len value. */

	msgq->ring_buffer_len = hdr->ring_buffer_len;

	if (msgq->ring_buffer_len > resource_size(&priv->buffer))

		return -ECONNRESET;

	/* Get tail_offset, making sure the value is valid. */

	offset = hdr->tail_offset;

	if (offset > resource_size(&priv->buffer))