Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aff47579 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "diag: Validate msg source length to prevent out of bound access"

parents 3c7ae57d 0e4c2597

drivers/char/diag/diag_masks.c

+2 −1
Original line number Diff line number Diff line
@@ -909,6 +909,7 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len, 
		goto end;

	if (mask_size + write_len > dest_len)

		mask_size = dest_len - write_len;

	if (mask_size && src_len >= header_len + mask_size)

		memcpy(dest_buf + write_len, src_buf + header_len, mask_size);

	write_len += mask_size;

	for (i = 0; i < NUM_MD_SESSIONS; i++) {