Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eafe6445 authored by Sreelakshmi Gownipalli's avatar Sreelakshmi Gownipalli Committed by Gerrit - the friendly Code Review server
Browse files

diag: Add conditional check for len in dci_process_ctrl_status() 



Add correct conditional check for len in dci_process_ctrl_status() to
prevent buffer overflow.

Change-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2
Signed-off-by: default avatarSreelakshmi Gownipalli <sgownipa@codeaurora.org>
parent b7d21b00

drivers/char/diag/diag_dci.c

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -831,7 +831,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token) 
	read_len += sizeof(struct diag_ctrl_dci_status);



	for (i = 0; i < header->count; i++) {

		if (read_len > len) {

		if (read_len > (len - 2)) {

			pr_err("diag: In %s, Invalid length len: %d\n",

			       __func__, len);

			return;