Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da07a1e4 authored by Sivan Reinstein's avatar Sivan Reinstein Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa: add a check for header len when adding a header to ipa 



The procedure which adds a header to the IPA was missing a boundary
check, causing a potential buffer overflow.

CRs-fixed: 791163
Change-Id: I4c372369feba1df68364a7c7b406e735147932d7
Acked-by: default avatarDavid Arinzon <darinzon@qti.qualcomm.com>
Signed-off-by: default avatarSivan Reinstein <sivanr@codeaurora.org>
parent de4207a8

drivers/platform/msm/ipa/ipa_hdr.c

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -577,7 +577,7 @@ static int __ipa_add_hdr(struct ipa_hdr_add *hdr) 
	int id;

	int mem_size;



	if (hdr->hdr_len == 0) {

	if (hdr->hdr_len == 0 || hdr->hdr_len > IPA_HDR_MAX_SIZE) {

		IPAERR("bad parm\n");

		goto error;

	}