Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 518cd856 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: ipa: prevent string buffer overflows"

parents 391db6bb 20dc293d

drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c

+6 −0
Original line number Original line Diff line number Diff line
@@ -2596,6 +2596,12 @@ int rmnet_ipa_query_tethering_stats(struct wan_ioctl_query_tether_stats *data, 
	struct ipa_get_data_stats_resp_msg_v01 *resp;

	struct ipa_get_data_stats_resp_msg_v01 *resp;

	int pipe_len, rc;

	int pipe_len, rc;





	if (data != NULL) {

		/* prevent string buffer overflows */

		data->upstreamIface[IFNAMSIZ-1] = '\0';

		data->tetherIface[IFNAMSIZ-1] = '\0';

	}



	req = kzalloc(sizeof(struct ipa_get_data_stats_req_msg_v01),

	req = kzalloc(sizeof(struct ipa_get_data_stats_req_msg_v01),

			GFP_KERNEL);

			GFP_KERNEL);

	if (!req) {

	if (!req) {

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+6 −0
Original line number Original line Diff line number Diff line
@@ -2754,6 +2754,12 @@ int rmnet_ipa3_query_tethering_stats(struct wan_ioctl_query_tether_stats *data, 
	struct ipa_get_data_stats_resp_msg_v01 *resp;

	struct ipa_get_data_stats_resp_msg_v01 *resp;

	int pipe_len, rc;

	int pipe_len, rc;





	if (data != NULL) {

		/* prevent string buffer overflows */

		data->upstreamIface[IFNAMSIZ-1] = '\0';

		data->tetherIface[IFNAMSIZ-1] = '\0';

	}



	req = kzalloc(sizeof(struct ipa_get_data_stats_req_msg_v01),

	req = kzalloc(sizeof(struct ipa_get_data_stats_req_msg_v01),

			GFP_KERNEL);

			GFP_KERNEL);

	if (!req) {

	if (!req) {