diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-07 08:31:56 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-07 08:31:55 -0700 |
| commit | 478a7073f5640a379e4b1d07948eeb8b54936020 (patch) | |
| tree | ead70bbd4c4895063012aeb00f1339b4a8ebb16b /drivers/char | |
| parent | 97aeb32ee2273d4e39a93ee5f11566271af993fd (diff) | |
| parent | a0085075f34df01d43eedae50a0b25b2389e39f8 (diff) | |
Merge "diag: Add proper checks to fix possible out-of-bound issue"
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/diag/diagchar_core.c | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/drivers/char/diag/diagchar_core.c b/drivers/char/diag/diagchar_core.c index 8ab22ee3bc3c..5ae3e4defd0d 100644 --- a/drivers/char/diag/diagchar_core.c +++ b/drivers/char/diag/diagchar_core.c @@ -1020,6 +1020,11 @@ static int diag_send_raw_data_remote(int proc, void *buf, int len, else hdlc_disabled = driver->hdlc_disabled; if (hdlc_disabled) { + if (len < 4) { + pr_err("diag: In %s, invalid len: %d of non_hdlc pkt", + __func__, len); + return -EBADMSG; + } payload = *(uint16_t *)(buf + 2); if (payload > DIAG_MAX_HDLC_BUF_SIZE) { pr_err("diag: Dropping packet, payload size is %d\n", @@ -1028,11 +1033,21 @@ static int diag_send_raw_data_remote(int proc, void *buf, int len, } driver->hdlc_encode_buf_len = payload; /* - * Adding 4 bytes for start (1 byte), version (1 byte) and - * payload (2 bytes) + * Adding 5 bytes for start (1 byte), version (1 byte), + * payload (2 bytes) and end (1 byte) */ - memcpy(driver->hdlc_encode_buf, buf + 4, payload); - goto send_data; + if (len == (payload + 5)) { + /* + * Adding 4 bytes for start (1 byte), version (1 byte) + * and payload (2 bytes) + */ + memcpy(driver->hdlc_encode_buf, buf + 4, payload); + goto send_data; + } else { + pr_err("diag: In %s, invalid len: %d of non_hdlc pkt", + __func__, len); + return -EBADMSG; + } } if (hdlc_flag) { |