Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ee7fcf9e authored by Skylar Chang's avatar Skylar Chang
Browse files

msm: ipa: prevent string buffer overflows 



On rmnet_ipa_set_data_quota() API, add the
string terminator to prevent vulnerability
of string buffer overflows on debug prints.

Change-Id: Ie669f6606f76b9006bce4edd0c6d04aef9cfb600
Signed-off-by: default avatarSkylar Chang <chiaweic@codeaurora.org>
parent 450bd44d

drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -2465,6 +2465,9 @@ int rmnet_ipa_set_data_quota(struct wan_ioctl_set_data_quota *data) 
	int index;

	int index;

	struct ipa_set_data_usage_quota_req_msg_v01 req;

	struct ipa_set_data_usage_quota_req_msg_v01 req;





	/* prevent string buffer overflows */

	data->interface_name[IFNAMSIZ-1] = '\0';



	index = find_vchannel_name_index(data->interface_name);

	index = find_vchannel_name_index(data->interface_name);

	IPAWANERR("iface name %s, quota %lu\n",

	IPAWANERR("iface name %s, quota %lu\n",

			  data->interface_name,

			  data->interface_name,

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -2557,6 +2557,9 @@ int rmnet_ipa3_set_data_quota(struct wan_ioctl_set_data_quota *data) 
	int index;

	int index;

	struct ipa_set_data_usage_quota_req_msg_v01 req;

	struct ipa_set_data_usage_quota_req_msg_v01 req;





	/* prevent string buffer overflows */

	data->interface_name[IFNAMSIZ-1] = '\0';



	index = find_vchannel_name_index(data->interface_name);

	index = find_vchannel_name_index(data->interface_name);

	IPAWANERR("iface name %s, quota %lu\n",

	IPAWANERR("iface name %s, quota %lu\n",

		  data->interface_name,

		  data->interface_name,