Commit 94cda67d authored Jan 29, 2018 by Sreelakshmi Gownipalli Committed by Gerrit - the friendly Code Review server Mar 01, 2018

diag: Add conditional check for len in dci_process_ctrl_status()



Add correct conditional check for len in dci_process_ctrl_status() to
prevent buffer overflow.

Change-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>

parent 07ec991e

drivers/char/diag/diag_dci.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -863,7 +863,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token)
		read_len += sizeof(struct diag_ctrl_dci_status);

		for (i = 0; i < header->count; i++) {
		if (read_len > len) {
		if (read_len > (len - 2)) {
		pr_err("diag: In %s, Invalid length len: %d\n",
		__func__, len);
		return;