Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a00cbbae authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "qseecom: Validate pointer offset in qseecom_send_modfd_cmd"

parents 48119a7f b1bc773c
Loading
Loading
Loading
Loading
+7 −0
Original line number Original line Diff line number Diff line
@@ -1635,6 +1635,13 @@ static int qseecom_send_modfd_cmd(struct qseecom_dev_handle *data,
		pr_err("response buffer address not within shared bufffer\n");
		pr_err("response buffer address not within shared bufffer\n");
		return -EINVAL;
		return -EINVAL;
	}
	}

	if (req.cmd_req_len == 0 || req.cmd_req_len > data->client.sb_length ||
		req.resp_len > data->client.sb_length) {
		pr_err("cmd or response buffer length not valid\n");
		return -EINVAL;
	}

	send_cmd_req.cmd_req_buf = req.cmd_req_buf;
	send_cmd_req.cmd_req_buf = req.cmd_req_buf;
	send_cmd_req.cmd_req_len = req.cmd_req_len;
	send_cmd_req.cmd_req_len = req.cmd_req_len;
	send_cmd_req.resp_buf = req.resp_buf;
	send_cmd_req.resp_buf = req.resp_buf;