diff options
| author | Manoj Prabhu B <bmanoj@codeaurora.org> | 2019-04-24 21:42:10 +0530 |
|---|---|---|
| committer | Manoj Prabhu B <bmanoj@codeaurora.org> | 2019-04-24 21:42:10 +0530 |
| commit | ef3ade93af0fb745eaff816e6f1ed42f6360f357 (patch) | |
| tree | 5d3025a4aaf1b017f245b35a398683aa62cefcb1 | |
| parent | 147ed3c774d9d87deaf67de226c7b16969e843f4 (diff) | |
diag: Prevent out of bound access while getting build mask
Add check for minimum length before typecasting to build mask
structure to prevent out of bound access.
CRs-Fixed: 2431005
Change-Id: I97b439ead62c8a67869c9209442ef771308f2d3f
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
| -rw-r--r-- | drivers/char/diag/diag_masks.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c index bb28958412ed..a460ce771249 100644 --- a/drivers/char/diag/diag_masks.c +++ b/drivers/char/diag/diag_masks.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2008-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2008-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -643,7 +643,8 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len, struct diag_build_mask_req_t *req = NULL; struct diag_msg_build_mask_t rsp; - if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) { + if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || + src_len < sizeof(struct diag_build_mask_req_t)) { pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d\n", __func__, src_buf, src_len, dest_buf, dest_len); return -EINVAL; |