Merge "diag: Add conditional check for len in dci_process_ctrl_status()" (7c7fcb66) · Commits · e / devices / android_kernel_xiaomi_sm6125

drivers/char/diag/diag_dci.c

+2 −2

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -867,7 +867,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token)
		read_len += sizeof(struct diag_ctrl_dci_status);

		for (i = 0; i < header->count; i++) {
		if (read_len > len) {
		if (read_len > (len - 2)) {
		pr_err("diag: In %s, Invalid length len: %d\n",
		__func__, len);
		return;