Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 98b264b0 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "diag: dci: Correct out of bounds check in processing dci pkt rsp"

parents 46de99c9 3629393a

drivers/char/diag/diag_dci.c

+1 −2
Original line number Diff line number Diff line
@@ -1952,7 +1952,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	if (!buf)

		return -EIO;



	if (len <= (sizeof(struct dci_pkt_req_t) +

	if (len < (sizeof(struct dci_pkt_req_t) +

		sizeof(struct diag_pkt_header_t)) ||

		len > DCI_REQ_BUF_SIZE) {

		pr_err("diag: dci: Invalid length %d len in %s", len, __func__);
@@ -1965,7 +1965,6 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	req_len -= sizeof(struct dci_pkt_req_t);

	req_buf = temp; /* Start of the Request */

	header = (struct diag_pkt_header_t *)temp;

	temp += sizeof(struct diag_pkt_header_t);

	read_len += sizeof(struct diag_pkt_header_t);

	if (read_len >= DCI_REQ_BUF_SIZE) {

		pr_err("diag: dci: In %s, invalid read_len: %d\n", __func__,