diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-04-27 07:06:29 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-04-27 07:06:28 -0700 |
| commit | 7428b8e268bfb093e7a428ba5bfbe842a1021327 (patch) | |
| tree | f383afdd3d4c45ae852c1afb87e82b2aa8e1bf56 /drivers | |
| parent | 99a42662cf9fc2c09af7143b00a6a18a62813a66 (diff) | |
| parent | 51d53940ea70b5af9418aba4028082b86365fa7b (diff) | |
Merge "diag: Fix to check for command length size"
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/char/diag/diagchar_core.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/char/diag/diagchar_core.c b/drivers/char/diag/diagchar_core.c index 574a13de6a0d..682c035c5bd4 100644 --- a/drivers/char/diag/diagchar_core.c +++ b/drivers/char/diag/diagchar_core.c @@ -996,6 +996,11 @@ static int diag_send_raw_data_remote(int proc, void *buf, int len, hdlc_disabled = driver->hdlc_disabled; if (hdlc_disabled) { payload = *(uint16_t *)(buf + 2); + if (payload > DIAG_MAX_HDLC_BUF_SIZE) { + pr_err("diag: Dropping packet, payload size is %d\n", + payload); + return -EBADMSG; + } driver->hdlc_encode_buf_len = payload; /* * Adding 4 bytes for start (1 byte), version (1 byte) and |