diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-04 01:20:58 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-04 01:20:57 -0700 |
| commit | 22d1c0de3bd8cf00cea37b5df21146daa645ed85 (patch) | |
| tree | 02168287d97e569d3077333583f9c5dcf391191d | |
| parent | 5f7c3c00d4a0fc80738b6cbc7b5ae9fd92d0bc7b (diff) | |
| parent | b726e73cebd56b316b43039d57a4c28791ad7248 (diff) | |
Merge "msm: ipa: prevent string buffer overflows"
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c | 3 | ||||
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c index c59c597f39bf..834712a71ac6 100644 --- a/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c @@ -2618,6 +2618,9 @@ static int rmnet_ipa_set_data_quota_modem(struct wan_ioctl_set_data_quota *data) if (!data->set_quota) ipa_qmi_stop_data_qouta(); + /* prevent string buffer overflows */ + data->interface_name[IFNAMSIZ-1] = '\0'; + index = find_vchannel_name_index(data->interface_name); IPAWANERR("iface name %s, quota %lu\n", data->interface_name, diff --git a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c index 5397b6c39419..039bc7da5153 100644 --- a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c @@ -2746,6 +2746,9 @@ static int rmnet_ipa3_set_data_quota_modem( if (!data->set_quota) ipa3_qmi_stop_data_qouta(); + /* prevent string buffer overflows */ + data->interface_name[IFNAMSIZ-1] = '\0'; + index = find_vchannel_name_index(data->interface_name); IPAWANERR("iface name %s, quota %lu\n", data->interface_name, |