diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2016-12-20 14:05:05 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-12-20 14:05:05 -0800 |
| commit | 67e606e70e8376b8035e7a334803422cf8ab7814 (patch) | |
| tree | 640a3c692349971d74aa7c065a5ad9b0045751de | |
| parent | 7636267d38b3f3711639c5c7a786ea0097e889ba (diff) | |
| parent | 6b7232dc9192dcf1ef9b887d76bd5ef88fe12572 (diff) | |
Merge "msm-3.18: drivers : added validation of input/output buffer sizes"
| -rw-r--r-- | drivers/misc/qseecom.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index 26676a51d83c..a7b3663ad7fe 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -80,6 +80,9 @@ /* Encrypt/Decrypt Data Integrity Partition (DIP) for MDTP */ #define SCM_MDTP_CIPHER_DIP 0x01 +/* Maximum Allowed Size (128K) of Data Integrity Partition (DIP) for MDTP */ +#define MAX_DIP 0x20000 + #define RPMB_SERVICE 0x2000 #define SSD_SERVICE 0x3000 @@ -6056,7 +6059,8 @@ static int qseecom_mdtp_cipher_dip(void __user *argp) } if (req.in_buf == NULL || req.out_buf == NULL || - req.in_buf_size == 0 || req.out_buf_size == 0 || + req.in_buf_size == 0 || req.in_buf_size > MAX_DIP || + req.out_buf_size == 0 || req.out_buf_size > MAX_DIP || req.direction > 1) { pr_err("invalid parameters\n"); ret = -EINVAL; |