Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8dea4b77 authored by Yuanyuan Liu's avatar Yuanyuan Liu
Browse files

icnss: NULL terminate the fw build timestamp string 



If fw build timestamp passed by QMI is a non-NULL terminated string,
it might result in a out-of-bounds read in icnss_get_soc_info. Hence,
manually NULL terminate the string.

Change-Id: I252196cd12784d841b29303c42591efc59da64f1
CRs-Fixed: 2322317
Signed-off-by: default avatarYuanyuan Liu <yuanliu@codeaurora.org>
parent f6347714

drivers/soc/qcom/icnss.c

+4 −0
Original line number Diff line number Diff line
@@ -1767,6 +1767,8 @@ EXPORT_SYMBOL(icnss_disable_irq); 


int icnss_get_soc_info(struct device *dev, struct icnss_soc_info *info)

{

	char *fw_build_timestamp = NULL;



	if (!penv || !dev) {

		icnss_pr_err("Platform driver not initialized\n");

		return -EINVAL;
@@ -1779,6 +1781,8 @@ int icnss_get_soc_info(struct device *dev, struct icnss_soc_info *info) 
	info->board_id = penv->board_id;

	info->soc_id = penv->soc_id;

	info->fw_version = penv->fw_version_info.fw_version;

	fw_build_timestamp = penv->fw_version_info.fw_build_timestamp;

	fw_build_timestamp[WLFW_MAX_TIMESTAMP_LEN] = '\0';

	strlcpy(info->fw_build_timestamp,

		penv->fw_version_info.fw_build_timestamp,

		WLFW_MAX_TIMESTAMP_LEN + 1);