Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d7601393 authored by Krishna chaitanya chundru's avatar Krishna chaitanya chundru Committed by Gerrit - the friendly Code Review server
Browse files

bus: mhi: Fix potential out-of-bound access 



In mhi_sat_isvalid_header function if the length is less than
the size of header then there can be out-of-bound access.

So fix the len check in the function.

Change-Id: I80f1556557b1bf2f30c07f6377bd6e3db48712b3
Signed-off-by: default avatarKrishna chaitanya chundru <quic_krichai@quicinc.com>
parent 7ca4537e

drivers/bus/mhi/devices/mhi_satellite.c

+2 −1
Original line number Diff line number Diff line
@@ -357,7 +357,8 @@ static struct mhi_sat_device *find_sat_dev_by_id( 
static bool mhi_sat_isvalid_header(struct sat_header *hdr, int len)

{

	/* validate payload size */

	if (len >= sizeof(*hdr) && (len != hdr->payload_size + sizeof(*hdr)))

	if ((len < sizeof(*hdr)) ||

		(len >= sizeof(*hdr) && (len != hdr->payload_size + sizeof(*hdr))))

		return false;



	/* validate SAT IPC version */