Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1a886ff9 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "diag: Check buffer size against command structure size"

parents f175c863 9a7a4b51

drivers/char/diag/diagfwd.c

+5 −3
Original line number Diff line number Diff line 
/* Copyright (c) 2008-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2008-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -684,7 +684,8 @@ int diag_process_time_sync_query_cmd(unsigned char *src_buf, int src_len, 
	struct diag_cmd_time_sync_query_req_t *req = NULL;

	struct diag_cmd_time_sync_query_rsp_t rsp;



	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) {

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

		src_len < sizeof(struct diag_cmd_time_sync_query_req_t)) {

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d",

			__func__, src_buf, src_len, dest_buf, dest_len);

		return -EINVAL;
@@ -711,7 +712,8 @@ int diag_process_time_sync_switch_cmd(unsigned char *src_buf, int src_len, 
	int msg_size = sizeof(struct diag_ctrl_msg_time_sync);

	int err = 0, write_len = 0;



	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) {

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

		src_len < sizeof(struct diag_cmd_time_sync_switch_req_t)) {

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d",

			__func__, src_buf, src_len, dest_buf, dest_len);

		return -EINVAL;