Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e756e60 authored by Manoj Prabhu B's avatar Manoj Prabhu B
Browse files

diag: Fix possible buffer corruption by proper typecasting 



This patch removes the possibilty of header length and read length
having negative values and thereby possible buffer corruption.

CRs-Fixed: 1002389
Change-Id: Id74650d5c4aaf9f84a56372f60ff5a40374e8f7b
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent 311cf263

drivers/char/diag/diagfwd_cntl.c

+2 −2
Original line number Diff line number Diff line
@@ -651,8 +651,8 @@ static void process_build_mask_report(uint8_t *buf, uint32_t len, 
void diag_cntl_process_read_data(struct diagfwd_info *p_info, void *buf,

				 int len)

{

	int read_len = 0;

	int header_len = sizeof(struct diag_ctrl_pkt_header_t);

	uint32_t read_len = 0;

	uint32_t header_len = sizeof(struct diag_ctrl_pkt_header_t);

	uint8_t *ptr = buf;

	struct diag_ctrl_pkt_header_t *ctrl_pkt = NULL;