Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a6a40ba9 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "diag: dci: Correct out of bounds check in processing dci pkt rsp"

parents 1aee16a8 17976c61

drivers/char/diag/diag_dci.c

+1 −2
Original line number Diff line number Diff line
@@ -1957,7 +1957,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	if (!buf)

		return -EIO;



	if (len <= (sizeof(struct dci_pkt_req_t) +

	if (len < (sizeof(struct dci_pkt_req_t) +

		sizeof(struct diag_pkt_header_t)) ||

		len > DCI_REQ_BUF_SIZE) {

		pr_err("diag: dci: Invalid length %d len in %s\n",
@@ -1971,7 +1971,6 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	req_len -= sizeof(struct dci_pkt_req_t);

	req_buf = temp; /* Start of the Request */

	header = (struct diag_pkt_header_t *)temp;

	temp += sizeof(struct diag_pkt_header_t);

	read_len += sizeof(struct diag_pkt_header_t);

	if (read_len >= DCI_REQ_BUF_SIZE) {

		pr_err("diag: dci: In %s, invalid read_len: %d\n", __func__,