Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17ba5cec authored by Gopikrishna Mogasati's avatar Gopikrishna Mogasati
Browse files

diag: Fix to check for command length size 



Fix to validate payload length size while forwarding
commands to remote processor.

CRs-Fixed: 2004417
Change-Id: Ia047f7895002409e176eeb9e1ddfef69849636ea
Signed-off-by: default avatarSreelakshmi Gownipalli <sgownipa@codeaurora.org>
Signed-off-by: default avatarGopikrishna Mogasati <gmogas@codeaurora.org>
parent b81d100b

drivers/char/diag/diagchar_core.c

+5 −0
Original line number Diff line number Diff line
@@ -965,6 +965,11 @@ static int diag_send_raw_data_remote(int proc, void *buf, int len, 
		hdlc_disabled = driver->hdlc_disabled;

	if (hdlc_disabled) {

		payload = *(uint16_t *)(buf + 2);

		if (payload > DIAG_MAX_HDLC_BUF_SIZE) {

			pr_err("diag: Dropping packet, payload size is %d\n",

				payload);

			return -EBADMSG;

		}

		driver->hdlc_encode_buf_len = payload;

		/*

		 * Adding 4 bytes for start (1 byte), version (1 byte) and